Trust and security
DocinVault is a Georgian company building guest compliance infrastructure for hospitality. This page explains what we protect, how the service is operated, which providers support it, and where customers can request more detail.
Who we are
DocinVault LLC builds the agentic compliance operations layer for regulated hospitality. The service connects guest collection, configured checks, routine follow-up, structured output, and booking-linked evidence.
What we protect
Our controls cover guest identity evidence, booking-linked sessions, workflow status, audit history, customer configuration, and access by authorized operator roles.
Security controls
Security is applied to the session, the information returned to an operator, and the people and systems allowed to use it.
Guest sessions use encrypted transport. Stored protected data is encrypted at rest through managed infrastructure controls.
Unique user accounts, least privilege, strong authentication, and access review limit who can use sensitive functions and information.
Guest evidence and decisions remain connected to the intended booking and workflow rather than being shared through routine staff channels.
Configured consent, timestamps, status changes, access, and review actions can be recorded against the relevant session.
Retention and deletion follow the customer's documented instructions, configured period, contract, and applicable obligations.
Operators receive the approved status and structured fields they need. Raw-document access is restricted and logged by default.
Infrastructure
DocinVault uses Amazon Web Services EMEA SARL for primary cloud infrastructure and data processing in the European Economic Area. Google Cloud EMEA Limited supports backup and restoration, with relevant servers in Frankfurt, Germany.
AWS protects the underlying cloud infrastructure. DocinVault remains responsible for its application, customer data, access configuration, encryption choices, and secure use of the services it selects.
Privacy and legal
DocinVault applies privacy, access, retention, data-subject request, and incident processes designed to support obligations under the Law of Georgia on Personal Data Protection and the GDPR where applicable.
Customers remain responsible for the purpose and lawful basis of each workflow, the fields and checks they enable, authorized users, retention, local reporting, and notices presented to guests.
A data processing agreement and current subprocessor information are available during customer review. This page is an operational overview, not legal advice or a claim of universal compliance.
Control baseline
These frameworks organize DocinVault's internal control baseline. This is a control mapping, not certification by the framework publishers.
Risk structure
Govern, Identify, Protect, Detect, Respond, and Recover organize ownership and security-risk decisions.
Security hygiene
A prioritized checklist for foundational inventory, access, configuration, vulnerability, recovery, and awareness controls.
Application and API catalog
A review catalog for authentication, access control, validation, cryptography, APIs, data, and secure application behavior.
Agentic-plane governance
Govern, Map, Measure, and Manage frame agent authority, observed behavior, risk evaluation, and intervention.
Subprocessors
The exact providers and processing arrangement for a customer deployment are governed by the applicable agreement and configuration.
Customer review
Controlled buyer level
Qualified customer and procurement reviews can receive deeper material appropriate to the proposed deployment and confidentiality level.
Product operations
Customer-specific service levels are agreed in the applicable contract. These operational objectives show what the service is instrumented to observe and protect.
Monitor successful creation, validation failures, idempotent replays, and latency.
Observe browser-flow reachability, step completion, retries, and service dependencies.
Measure event creation, signed webhook attempts, acknowledgements, retries, and final delivery state.
Responsible disclosure
Send a clear description, affected URL or component, reproduction steps, and the potential impact to contact@docinvault.com. Please avoid accessing data that is not yours, disrupting service, or publicly disclosing an unresolved issue. We will acknowledge the report, assess it, and keep the reporter informed as the investigation allows.
