Trust & residency
The questions your IT department and your auditor will both ask
Answered here rather than in a sales call, because the answer to most of them is a design decision that was made before the first line of code.
Hosting
Tenant isolation
Audit trail
Identity
Model training
Validation pack
01
Data residency
Records at rest never leave the customer region
For Gulf customers everything runs in Azure UAE North. Your quality records, the files behind them and the indexes built from them stay there. Where a language-model call is involved, that call is transient processing under contractual no-training and retention terms — we say exactly that, rather than implying the model runs in your data centre.
- Databases, files, backups and search indexes in-region
- Per-tenant encryption keys on object storage
- Embeddings generated by models we host in-region
- Region is a per-tenant configuration, not a global default
02
Tenant isolation
Enforced by the database, not by application code
Multi-tenancy was in the design from the first commit, because it is not retrofittable and a leak between two competing manufacturers would be unforgivable. Isolation is enforced one layer below the application: even a defect in application code does not produce cross-tenant reads. We deliberately do not deduplicate identical files across tenants, because a deduplication hit is itself a disclosure that another customer holds that document.
- A tenant identifier on every row of tenant data
- Row-level security policies enforced in PostgreSQL
- Embeddings, clusters and indexes tenant-scoped
- File deduplication within a tenant only — never across
03
Tamper evidence
Append-only events, anchored monthly
Every regulated action is an event in an append-only, hash-chained log. Each event's digest covers the previous one, so altering history breaks every digest that follows. Each month's head is written to storage with an immutability policy — a single value that proves a whole month of history is intact. There is no administrative interface that edits or deletes events, for your staff or for ours.
Audit trail · 2026-08 partition
- #00412Revision approved9c1f…04ab
- #00413Signature executeda70e…5d12
- #00414Revision effective2b88…ff90
- #00415Predecessor withdrawnd415…7c33
Month head anchored · WORM
One value, stored where it cannot be changed. Check it and the whole month is proven untampered.
Each digest covers the one before it. Change any event and every digest after it stops matching — including the anchored head.
04
Identity & signing
Your IdP proves identity; Doqumus holds the roles
Your identity provider answers “who is this person”. Quality roles — document owner, approver, quality manager, trainee — live in Doqumus and are optionally mapped from your directory groups, so an IT group change never silently alters who can approve a procedure.
- OIDC and SAML federation to Entra ID or ADFS
- Local accounts with mandatory MFA where there is no IdP
- Step-up re-authentication at every signature
- Login, logout and failed-auth recorded in our own event log
05
Your content stays yours
Ownership, portability and training
The contract says your content is yours and is never used to train models; the architecture makes cross-tenant use impossible rather than merely prohibited. If you leave, you leave with your controlled documents, your records and a verifiable copy of your audit trail.
- Your documents and records remain your property
- No training of models on your content, by us or by a provider
- Export of documents, records and the audit trail
- Retention and legal hold honoured on disposal
06
How we build it
Because your supplier audit will ask
The validation package is generated by our build pipeline rather than written afterwards: requirements, the tests that cover them, and the traceability between them, regenerated on every release and shipped with it. Incumbents sell theirs separately; it is included in every Doqumus tier.
- Requirements, risk classes and traceability to tests
- Every dependency licence-checked and vulnerability-scanned in CI
- Migrations version-controlled as change-control evidence
- A written standard for how AI assistance is governed in our own engineering
What we don't claim
The limits, stated plainly
A vendor that overstates its certifications is a finding waiting to happen — yours, not just ours.
We are not ISO 27001 certified
The controls described here are real and evidenced. A certification is a separate exercise; we will tell you where that stands rather than imply a badge we do not hold.
Language-model calls are processing, not residency
Records at rest stay in your region. When AI features run, content is processed transiently by a model provider under no-training and retention terms — or not at all, if you turn AI off.
Software supports your QMS, it does not guarantee an audit
Doqumus makes the evidence real and the controls automatic. Passing a certification audit remains the work of your quality system and your people.
Send us your security questionnaire.
We would rather answer it early than late. Same for your IT department's architecture questions and your certification body's expectations of a software vendor.