Security, privacy, and data handling

eDocify processes invoices, receipts, contracts, archive records, and related business documents. These documents can contain supplier data, customer data, bank accounts, tax identifiers, employee information, commercial terms, and other sensitive business content.

Security is therefore a product requirement, not a later add-on.

Security principles

Principle	Product approach
Tenant isolation	Separate customer context for users, documents, configuration, workflow state, and audit records.
Least privilege	Role-based access and product scopes limit what each user can see and do.
Human oversight	AI extraction supports humans; critical business fields can require verifier approval.
Auditability	Intake, verification, approval, export, archive, and admin actions are designed to produce traceable events.
Secure secrets	ERP credentials, API keys, and AI provider keys should be stored in a managed secret store such as Azure Key Vault.
Data minimization	AI and OCR providers should receive only the data needed for the specific processing task.
Production guardrails	Non-development environments must reject unsafe defaults, demo fallbacks, weak secrets, and open CORS.
Evidence preservation	Archive records should include metadata, retention status, legal hold state, and evidence history.

Role-based access model

eDocify separates user responsibilities across product roles:

• system administrator;
• tenant administrator;
• client administrator;
• accountant;
• verifier;
• approver;
• finance director;
• integration administrator;
• AI learning user;
• auditor;
• viewer.

The target enterprise model is capability-based access control. The frontend should receive allowed capabilities from the backend instead of duplicating role rules manually.

Data lifecycle

flowchart LR
  A["Document received"] --> B["Stored original"]
  B --> C["OCR / AI processing"]
  C --> D["Human verification"]
  D --> E["Approval and ERP export"]
  E --> F["Archive and retention"]
  F --> G["Legal hold or disposal"]

AI provider data handling

eDocify can support multiple OCR and AI providers, including Azure Document Intelligence, Mistral OCR, local OCR routes such as Tesseract, RapidOCR, and PaddleOCR, and .NET-based machine learning components. For each provider route, customer deployments should document:

• what data is sent;
• which region processes it;
• whether provider-side training is disabled;
• how long temporary processing data is retained;
• how failed requests are logged;
• whether customer-specific keys are used;
• whether local OCR is available for sensitive document classes.
• whether .NET machine learning models are trained only on approved customer datasets or anonymized samples.
• whether local LLM routes such as Ollama-hosted Qwen3 are used only inside controlled infrastructure and whether their prompts, model versions, and JSON outputs are logged for audit and quality review.

Local OCR, hybrid routing, the proprietary eDocify AI Learning engine, and .NET machine learning routes are important for enterprise deployments because some document classes may need private processing, offline benchmarking, customer-controlled training data, or a fallback path when an external OCR/AI provider is unavailable.

Hybrid processing also lets a customer choose different routes by document class:

• sensitive documents can use local OCR first;
• standard invoices can use cloud AI first;
• high-value invoices can require AI extraction plus human verification;
• low-confidence fields can be reprocessed through another provider;
• ERP export fields can be validated with deterministic accounting rules before leaving eDocify.
• verified corrections can be kept as customer-controlled learning signals for future extraction and quality improvement.
• local-only experiments can process PDF/JPG invoices through RapidOCR or PaddleOCR, structure OCR text with Ollama qwen3:8b or qwen3:30b, and accept output only after JSON schema validation.

Enterprise security roadmap

Capability	Status
Role-based access control	Implemented / expanding
Audit trail	Implemented / expanding
Production unsafe-config guard	Implemented in main API
Archive API production hardening	Next priority
Encryption in transit	Required for production
Encryption at rest	Required for production
Key Vault / managed secrets	Planned for Azure deployments
SSO / Microsoft Entra ID	Planned enterprise capability
SCIM provisioning	Planned enterprise capability
MFA policy	Planned enterprise capability
SIEM export	Planned enterprise capability
Data retention policies	Implemented / expanding
Legal hold	Implemented / expanding
Customer data deletion workflow	Planned enterprise capability

Customer-facing security evidence

Before enterprise go-live, each pilot should produce:

• environment checklist;
• data flow summary;
• access matrix;
• retention policy;
• AI provider usage statement;
• backup and restore plan;
• incident response contacts;
• audit evidence sample;
• go-live security sign-off.

Funding-ready message

eDocify is designed for sensitive document operations. Startup infrastructure support would help Bitlogika build secure pilot environments with tenant isolation, managed secrets, monitoring, encryption, role governance, and audit-ready records.