DocPro · Security
PTAS DocPro Security
What happens to a document inside DocPro, from upload to deletion, in plain terms.
Lifecycle
From upload to deletion
A document leaves DocPro in one of two ways: as a record exported to the systems you named, or by deletion when your retention period ends. Both are recorded.
Illustrative example: one KYC pack, upload to deletion
Illustrative data. The retention period comes from your policy. The platform's job is to apply it and leave a record that it did.
Identity documents make the point most clearly, so the figure follows one KYC pack. The same stages apply to an invoice or a bank statement. What changes is who is allowed to open it, which fields are masked on the way out, and how long your policy says to keep it.
Every stage writes to the audit log. That log is what lets you answer an access request or an auditor's question months later without reconstructing anything: when the document arrived, what the model read, who looked at it, what left the platform and when it was removed.
Access
Who can open a document
Access is set by role. Processing a case and seeing the identity document behind it are two different permissions.
Illustrative example: who can open one passport scan
Illustrative data. Seeing an unredacted identity document is a permission of its own, granted separately from the right to process the application.
In most teams, far fewer people need to see a passport scan than need to know the onboarding passed. Role-based access lets you draw that line once, in configuration, and have it hold for every case. A reviewer opens a held case and sees the field in doubt and the page it came from. An onboarding coordinator sees the status. A downstream system sees what its export rule allows.
The same applies to configuration. Who can change a confidence threshold, a validation rule or a redaction rule is a role of its own, and every change records who made it and when.
Redaction
Field-level redaction on export
DocPro holds the full extraction under access control. What leaves the platform is decided per field and per destination.
Held internally against exported · Illustrative example
Masking is set per field and per destination, so a KYC reviewer and a billing system receive different versions of the same record.
Redaction on export is available for identity data and for any other field you classify as sensitive: a bank account number on a supplier invoice, an employee ID on an expense receipt. The rule is set per destination, so the KYC system and the billing system can receive different versions of the same record without anyone maintaining two copies.
Redaction applies to what leaves. Inside DocPro, the unmasked values stay available to the roles allowed to see them, because a reviewer cannot settle a held document number they cannot read.
Controls
Four controls on every document
They come from the company-wide Security model and apply to every agent, standard or custom, from the first document type you put live.
Role-based access
Who can open a document, settle a held field or change a threshold is set by role. Seeing an unredacted identity document is a separate permission from processing the case.
Encryption
Documents and extracted data are encrypted in transit and in storage. Key management follows the deployment model you choose.
Audit log
Who read what, what the model returned, what a person changed and when. Kept with the case and exportable for your auditors.
Human review
A field the agent cannot read confidently goes to a named role with the reason attached. It is never filled in quietly.
Deployment and retention
Where documents live, and for how long
The agents and controls are the same in every model. What changes is whose infrastructure DocPro runs on and who holds the keys.
Managed by PTAS AI
Cloud
DocPro runs in the region you choose, with access, encryption and audit controls managed by us. The quickest route to a first document type in production.
Your cloud account
Private cloud
DocPro runs inside a cloud environment you control, so network rules and access policies stay with your team.
Your infrastructure, where supported
On-premise
For policies that do not allow documents to leave your own systems, including air-gapped setups for regulated workloads.
Documents and extracted data are held for the period your retention policy sets, then removed, with the deletion recorded against the case. The period is yours to set during onboarding, and we would rather you brought the policy to the first meeting than discovered the question at go-live.
Our security practices are aligned with ISO/IEC 27001, and we design for GDPR readiness where our customers process EU personal data. We are not certified against either, and nothing on this page should be read as saying so.
The public test
What happens to a file uploaded to the DocPro test
The public test is not a deployment, and its files are handled differently. Your retention policy does not apply to them, because you have not set one with us yet.
Processed for the extraction
The file goes to the DocPro extraction service for that one run. The result comes back inside the response to your browser.
Stored for the test and quality review
It is kept on PTAS AI infrastructure so that when a read goes wrong, the team can put the fields next to the page and find out why. Retention is described in the privacy policy.
Not public
Nothing is published. The preview is sent back inside the response instead of being served from a link, so there is no file address to guess, bookmark or forward.
Not used to train models
An uploaded document does not become training data. What the team takes from a bad read is a defect to fix.
Use a document you are entitled to share, and mask anything you must; a masked field comes back blank, which is the correct result. If your policy does not allow a document to go to a public test at all, skip it and ask for a demo instead. The deployment model your policy requires can be settled before any document changes hands.
FAQ
Questions security and compliance teams ask
Is DocPro ISO 27001 certified?
No. PTAS AI security practices are aligned with ISO/IEC 27001 and delivery practices with ISO 9001. We hold neither certification and we do not claim to. DocPro runs under the same practices as the rest of the platform, and we are glad to walk your security team through the controls themselves.
Where are our documents stored?
In the deployment you choose: cloud in the region you select, a private cloud account you control, or on-premise, including air-gapped setups, where supported. Documents and extracted data stay inside that boundary.
How long are documents kept?
For the period your retention policy sets. At the end of it they are removed and the deletion is recorded against the case. Files uploaded to the public DocPro test are handled differently: they are stored for the test and quality review, and their retention is described in the privacy policy.
Are our documents used to train models?
Customer documents are processed to do the work you have configured. Files uploaded to the public DocPro test are not used to train models. Any other use of your data is set out in your agreement, and we do not go beyond it.
Can we decide which fields are masked, and for whom?
Yes. Redaction is set per field and per destination. A common split masks the document number and date of birth on export while keeping the name and the verification result, but the split is yours, and two downstream systems can receive different versions of the same record.
What does a reviewer see?
The page and the field in doubt, with the reason it was held, provided their role gives them access to that document. The correction is logged against the field and against the reviewer, so the record shows who changed what.
Keep reading
Related reading
Security
The company-wide controls, deployment models and incident handling this page applies to DocPro.
Read more →KYC & Identity Agent
Identity fields read, cross-checked and masked on the way out.
Read more →DocPro Integrations
Where records go after DocPro, and how each route is connected.
Read more →AI Security and Governance
How agents are bounded, versioned and audited across the platform.
Read more →Next step
Test with a document you are allowed to share
Mask what you must and upload it. For a deployment, bring your retention policy and your redaction rules to a demo, and we will show where each one is applied.