Security at DocDrawer
DocDrawer handles invoice and payment-instruction data on behalf of letting agents. We take the security of that data seriously — what follows is how, in concrete terms.
DocDrawer handles invoice and payment-instruction data on behalf of letting agents. We take the security of that data seriously — what follows is how, in concrete terms.
/.well-known/security.txt.
The single most important security boundary in DocDrawer is the one between us and supplier bank account numbers. Two rules together make a compromised DocDrawer environment unable to redirect any payment:
1. DocDrawer never writes bank details to PayProp. Account numbers, sort codes, and branch codes are entered directly in PayProp by an authorised PayProp user. DocDrawer's supplier-create flow strips bank-shaped fields client-side and never sends them on the wire. When a payment is published, it uses PayProp's stored bank details — never the invoice's. A compromised DocDrawer account therefore cannot change where money goes.
2. DocDrawer never stores a full account number. The fraud-detection check that compares an invoice's printed bank details against PayProp's record needs some persistent reference for repeat suppliers. DocDrawer stores only the sort code plus the last 4 digits of the account number — the same shape PayProp's own API surfaces back to us (the API masks the rest). Full account numbers exist in memory only for the duration of the per-invoice check, then are discarded. A database-level breach yields (sort, last-4) pairs which on their own cannot redirect a payment.
Defence in depth at review time: when an inbound invoice has bank details printed on it (most contractor invoices do), DocDrawer compares the sort code and last 4 digits against PayProp's record. A green "✓ Verified" pill appears next to the supplier name when both match. A red "⚠ Bank mismatch" pill and warning banner appear when they differ, with one-click links to open the supplier in PayProp and re-check after updating. The mismatch is a detection event, not a payment-failure mode — the underlying payment still routes through PayProp's stored bank details regardless.
The check only runs when the primary supplier match (name / email / company registration / VAT) is already strong, so weak matches don't trigger noisy banners. And the verification deliberately doesn't reveal more than PayProp itself does — DocDrawer compares last-4 against last-4, never against a full account it shouldn't have.
This architecture is recognised by professional indemnity insurers and property-industry bodies (RICS, ARLA).
All customer data is hosted on Amazon Web Services (eu-west-2 / London). DocDrawer uses two managed platforms on top of AWS:
Both Supabase and Vercel are SOC 2 Type II certified. Data does not leave the EU.
Offsite backups: nightly encrypted snapshots are written to Wasabi (also AWS eu-west-2 / London, but a separate provider account). Backups use AES-256-GCM client-side encryption and Wasabi Object Lock in Compliance mode — once written, neither DocDrawer nor an attacker holding our credentials can delete or alter them for 30 days. This is the primary defence against ransomware, accidental deletion, and Supabase-side data loss.
DocDrawer uses the following third-party services to deliver the product. Each is bound by a data-processing agreement and each maintains its own security certifications.
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Underlying compute and storage (via Supabase + Vercel) | EU (eu-west-2) |
| Supabase | Database, authentication, file storage | EU (eu-west-2) |
| Vercel | Application hosting, serverless API runtime | EU + global edge |
| Resend | Transactional email (inbound and outbound) | EU + US |
| Anthropic | AI-assisted document extraction (Claude) | US |
| Plain | In-app customer support widget | EU + US |
| Sentry | Error tracking and observability (PII scrubbed) | EU |
| Wasabi | Encrypted offsite backups (Object Lock Compliance, 30-day immutability) | EU (eu-west-2) |
| Upstash | Rate-limit counters (Redis); keyed by user ID / IP, no invoice or document content | EU |
| Voyage AI | Text embeddings of invoice content for supplier and property matching | US |
| PayProp | Property-management integration (customer-controlled) | EU + global |
| Xero | Accounting integration (customer-controlled) | EU + global |
npm audit runs on every pull request; gitleaks blocks accidental secret commits.Sensitive administrative actions are recorded with the acting admin, target, timestamp, IP, and user-agent:
Customer data is retained while the customer's account is active. On account closure, data is retained for 90 days to allow recovery (after which it is purged from primary storage). Backups follow their own retention schedule, documented in our disaster-recovery plan and available on request.
Customers can request export or deletion of their data at any time by emailing support@docdrawer.co.uk. We respond within one working day.
If a security incident affects customer data, we will notify affected customers by email without undue delay — and within 72 hours of becoming aware of it, in line with our obligations under UK GDPR. Notification includes what happened, what data was affected, what we have done, and what affected customers should do.
If you believe you have found a security vulnerability in DocDrawer:
DocDrawer is being built toward Cyber Essentials certification (UK government scheme). SOC 2 and ISO 27001 are on the roadmap when customer demand justifies the audit cost. Our underlying platforms (AWS, Supabase, Vercel, Resend, Sentry) maintain SOC 2 Type II certification today.