Secure document management and access control

Permissions are assigned by role and applied per module, and the levels are deliberately finer than read/write. A user can be granted preview only, upload only, preview and download, editor, or a custom combination. The distinction between preview and download is the one that matters most in practice: it is the difference between letting someone read a confidential document and letting them keep a copy.

Roles are composed rather than fixed, so an auditor role can be built as read-everywhere-download-nothing without inventing a new user type. Folder permissions are inherited by the documents inside them, with per-document overrides where a genuine exception exists — and because overrides are the thing that quietly undoes a permission model, they are visible in the shared-access overview rather than buried per document.

Two-factor authentication uses time-based one-time codes and can be enforced per role, so approval and administrative roles can be required to use it without imposing it on every occasional reader. Sessions use refreshable tokens, and credentials for connected systems are stored encrypted rather than in configuration.

Single sign-on runs over OIDC with Microsoft Entra ID, Okta and Google Workspace. SSO is not primarily a convenience feature here: it is how leavers lose access. When a directory account is disabled, the user cannot authenticate to DocumentMS, which removes the gap between an HR leaver process and a document system nobody remembered to update.

Documents are encrypted at rest with 256-bit encryption and in transit over TLS. Where you use your own storage backend — an S3 bucket or Azure container in your account — key management and immutability policies remain under your control and your logging.

Access can be restricted to known networks by IP, per user or per role. This is a blunt control and it suits blunt requirements: a role that only ever operates from an office or a VPN should not be usable from anywhere else, and saying so in configuration is stronger than saying so in a policy.

Minimum length, complexity requirements, rotation interval and reuse history are configurable. We have an opinion — length beats complexity, and forced rotation on a short cycle produces worse passwords, not better ones — but the requirement usually comes from a framework you are being audited against rather than from first principles, so the policy is yours to set.

Three independent backup copies are maintained. The number matters less than the practice around it: a backup that has never been restored is a hypothesis, so restore testing is part of the operating routine rather than an annual exercise.

Recovery point and recovery time objectives, and the region each backup copy is held in, are set out in the trust centre. Those are commitments rather than capabilities, which is why they belong on a page you can hold us to.

There are genuine situations where someone needs access they do not normally hold: an investigation, an incapacitated document owner, a live incident. Pretending otherwise produces the worse outcome, where an administrator quietly grants themselves permissions and nobody notices.

Break-glass access is therefore an explicit, time-boxed grant that raises an alert when it is used and is recorded in the audit trail as a distinct event type. It is designed to be visible rather than convenient, which is the correct trade-off for a control of last resort.

Subject access requests need every document mentioning a person to be findable, and erasure requests need a deletion that is genuine and evidenced. Search across contents and metadata covers the first; permanent deletion with an audit entry covers the second.

Erasure interacts with retention, and the interaction is not always in the subject’s favour: a record held under a statutory retention obligation cannot simply be deleted on request. DocumentMS surfaces the retention rule attached to a document when an erasure action is attempted, so the decision is made with the conflict visible rather than discovered later.