Security
KaryaDocs holds client-identity documents — passports, PAN, and similar. Here is what actually protects them, stated plainly rather than left to a sales call.
Tenant data isolation
Your data is isolated at the database level, not just by a login check. Every business's records are structurally separated, so one business's data cannot reference another's — it is a property of the schema, not a check that can be forgotten in one screen.
Encryption in transit and at rest
Documents and stored access tokens are encrypted both in transit and at rest.
Malware protection
Files are held on infrastructure with server-level malware protection today. Scanning every individual file at the moment of upload is on our roadmap — we'll update this page the day it ships.
Full access audit trail
Every document view and download is logged. The same mechanism logs when our own support staff access a tenant's data during impersonation — with a visible banner shown to your team when that happens.
What we don't do yet
Two things a security-conscious prospect would reasonably ask about, answered directly rather than left for a sales call:
- No OTP-gated upload links yet.
- No client portal login yet — the upload link is the only client-facing entry point.
Both are on the roadmap. In the meantime, the compensating controls already in place: the public upload page is write-mostly, links are scoped to a single request, and they expire quickly.