Bank-grade security for Indian enterprise document management
HridayamSoft Solutions — the company behind ShareDocs — holds dual ISO 27001:2022 and SOC 2 Type II certifications. Enterprise document management security India organisations require must be independently audited infrastructure. Trusted by NSE, NSDL, and India's leading regulated institutions.
Certifications & Compliance Evidence
ShareDocs is an ISO 27001 ECM platform — all assessments conducted by CERT-In empanelled or IAF-accredited laboratories, not self-assessments. For ECM ISO 27001 verification, certificate reference numbers and scope details are available on request.
Two Independent Layers of Encryption — Every Document, Always
Documents encrypted twice — once by the application, once at the storage layer. Both layers are active simultaneously, by design, not by configuration.
Per-Tenant Isolation — Full Separation at Every Layer
Cross-tenant data access is architecturally impossible in ShareDocs. Isolation is enforced at database, storage, application, and AI processing layers — not by access policy alone.
Dedicated MySQL Database
A dedicated MySQL database is automatically created for each new tenant at onboarding. No shared tables, no shared schemas, no cross-tenant queries. Credentials are unique per tenant.
Zero shared tablesDedicated Amazon S3 Bucket
All documents are stored in a dedicated S3 bucket per tenant. IAM policies enforce scoped Get/Put Object access — cross-bucket access is architecturally impossible for any user or role.
IAM-scoped per tenantApplication Layer Isolation
Tenant-context validation is enforced on every API call and session. A logged-in user can only ever access data belonging to their own tenant — at every layer of the application, always.
Enforced on every API callRegional AI Processing
OCR and AI processing runs on dedicated regional servers — India for India-region deployments, Singapore for APAC. No cross-region data sharing. No document content is retained after processing completes.
Ephemeral — no retentionLayered Access Controls — Who Can Act, and Exactly Where
No default open access, ever. Every user's permissions are explicitly defined at role, document type, folder, and action level before they can interact with any content. This is ECM with granular permissions and audit trails — ECM security compliance requires controls at this level, not just role-level access.
Role-Based Access Control (RBAC)
Governs what each user can do system-wide: view, upload, download, approve, share, delete. Admin, User, and Auditor roles provide clear operational boundaries. Bulk import via CSV.
Granular Permissions
Permissions defined at document type, folder, subfolder, and individual action level. Rights bulk-assigned to groups via CSV. No user sees content outside their explicit scope.
MFA & SSO
OTP-based MFA transitioning to TOTP (Google Authenticator). Active Directory, LDAP, and SAML 2.0 integration — enforce your organisation's existing identity policies.
Password Policy
Minimum length, complexity, account lockout, and CAPTCHA. Governed by POL 006 Password Policy v1.2 under the certified ISO 27001 ISMS.
Separation of Duties
Administrators and business users operate in separate permission domains. Segregation of duties register maintained per ISO 27001 controls (FRM 009, FRM 016).
Digital Signatures
Three signature methods supported: Aadhaar-based e-sign (UIDAI verified), standard e-sign, and hardware token-based signatures. All events logged with timestamp and verification record.
Immutable Audit Trails — Every Action, Every User, Every Document
ISO 27001:2022 compliant logging across all document, workflow, authentication, and administrative events. ShareDocs logging is tamper-resistant via AWS CloudTrail.
What is captured
- Document uploads, downloads, views, edits, deletions, version changes
- All sharing events — internal, external, and encrypted-link shares
- Workflow events: submission, approval, rejection, delegation, escalation
- Authentication events: logins, failed attempts, password changes
- Administrative actions: user creation, role changes, permission updates
- Digital signature events: signing and verification records
- API calls: timestamp, user, action — every integration event logged
Tamper-Resistant Infrastructure Audit
Admin access controls and AWS CloudTrail provide an independent, tamper-resistant infrastructure audit record that cannot be altered by application-layer administrators.
Real-Time Monitoring & Alerting
CloudWatch deployed in production for real-time infrastructure and application monitoring with automated alerting on anomalous activity patterns.
ISMS-Governed Logging Policy
All logging practices governed by the certified ISMS. Log retention, access control, and review procedures formally documented and audited annually.
Secure Development Lifecycle
100% in-house development. No outsourcing. OWASP aligned. ISO 27001 Control 8.25 implemented. SonarQube static analysis in CI/CD — Critical and High findings block release. ShareDocs document management and workflow automation capabilities are both governed under the certified ISMS — enterprise document security starts at the code level.
Incident Response SLA — ISO 27001:2022 Controls 5.24–5.28
Documented severity tiers with defined response, escalation, and restoration targets. Critical incidents escalate to engineering and the Founder & MD within 1 hour.
| Severity | First Response | L1 → L2 | L2 → L3 | Restoration Target | Update Frequency |
|---|---|---|---|---|---|
| Critical | 30 min | 30 min | 1 hour | 4 business hours | Every 1 hour |
| Medium Critical | 2 hours | 4 hours | 8 hours | 1 business day | Daily |
| Non-Critical | 8 hours | 1 day | 2 days | 3–5 business days | Every 2 days |
AI Security — OpenAI Enterprise API with Zero Data Retention
ShareDocs uses the OpenAI Enterprise API — which provides contractual guarantees of no data retention and no use of customer content for model training. AI processing is ephemeral by design.
No Retention. No Training.
OpenAI Enterprise API contractually guarantees that no content submitted for processing is retained after the session, and that it is never used to train or improve OpenAI models. Your documents do not leave your tenancy to train AI.
OpenAI Enterprise APIEncrypted at Every Step
All communications between ShareDocs and the OpenAI API use TLS 1.3. Data at rest in the AI middleware layer is protected by AES-256. Middleware logs retained for 7–30 days by admin-configurable policy, then purged.
TLS 1.3 + AES-256Ephemeral Processing
Document content sent to the AI pipeline is processed and discarded — never persisted to a shared store. Temp files are auto-deleted post-session. Elasticsearch index receives only structured extracted data, not raw document content.
Session-scoped onlyAdmin Governance Controls
Administrators configure which users have access to AI features, set OCR/RAG retry policies, define prompt templates, and monitor user-wise AI usage reports — all through the standard ShareDocs admin UI.
Admin-controlled accessOpenAI Enterprise compliance: The OpenAI Enterprise API used by ShareDocs is independently assessed as SOC 2, GDPR, and HIPAA compliant. This means the AI processing pipeline that powers ShareDocs AI features meets the same compliance standards as the core platform.
Common Questions on Document Management Security in India
Is ShareDocs ISO 27001 certified?
HridayamSoft Solutions Pvt. Ltd. — the company that builds and operates ShareDocs Enterpriser — holds ISO/IEC 27001:2022 certification (Reg. IC-IS-2405235) issued by InterCert, an IAF-accredited body. The certification covers 93 controls, all implemented. Valid May 2026 to May 2027. ShareDocs runs entirely on this certified infrastructure.
Is ShareDocs SOC 2 certified?
Yes. HridayamSoft Solutions completed SOC 2 Type II certification in May 2026. SOC 2 Type II means controls were audited over an observation period — not just a point-in-time snapshot. The audit covers Security, Availability, and Confidentiality Trust Services Criteria as defined by the AICPA.
How is data encrypted in ShareDocs?
Every document is encrypted twice and independently. Layer 1: AES-256 at the application level by ShareDocs before the file is written to storage. Layer 2: AWS S3 server-side encryption at the storage level. Both layers are active simultaneously. All data in transit uses TLS/HTTPS. No plaintext communication is permitted anywhere in the system.
Can one tenant's documents be accessed by another tenant or by HridayamSoft staff?
Cross-tenant access is architecturally impossible. Each tenant has a dedicated MySQL database with unique credentials — no shared tables or schemas exist. Each tenant has a dedicated S3 bucket with IAM policies that restrict access exclusively to that tenant. At the application layer, tenant-context validation is enforced on every single API call. There is no mechanism — even at the administrator level — to query across tenant boundaries.
What security testing does ShareDocs undergo, and how often?
ShareDocs undergoes independent security assessments by CERT-In empanelled laboratories. In May 2026: Web Application VAPT by Techdefence Labs — Safe-to-Operate certified. Penetration test by Terasoft Technologies (CERT-In/STQC) — all findings remediated. Source code review by Terasoft — 369,032 lines reviewed, free from Critical and High vulnerabilities. Policy requires minimum one VAPT and one source code review per year, with additional assessments at major releases and on customer request.
Does ShareDocs retain data processed by AI features?
No. ShareDocs uses the OpenAI Enterprise API, which provides contractual guarantees of no data retention and no use of submitted content for model training. Document content sent for AI processing is handled ephemerally — it is not retained after the session ends. All AI communications use TLS 1.3. Data at rest in the AI middleware is protected by AES-256. Middleware logs are retained for 7–30 days by admin-configurable policy.
What is the incident response SLA for critical issues?
For Critical incidents: first response within 30 minutes, escalation to L2 within 30 minutes, escalation to L3 (engineering and Founder & MD) within 1 hour, restoration target of 4 business hours, and status updates every hour. The SLA is governed by ISO 27001:2022 Controls 5.24–5.28 and is formally documented.
Can ShareDocs be deployed on-premise for banks with data residency requirements?
Yes. ShareDocs supports full on-premise deployment for banks, NBFCs, and RBI-regulated institutions requiring data residency. The client provides and manages server infrastructure; HridayamSoft deploys and configures the application layer. Supports intranet-only operation — no public internet required. Air-gapped environment support available on request. On-premise deployments are live in approximately 2 weeks.
What is a secure enterprise document management system?
A secure enterprise document management system combines encryption, access control, audit logging, and independent certification into one platform. ShareDocs delivers this through dual-layer AES-256 encryption, per-tenant isolation, role-based access control with MFA, immutable audit trails via AWS CloudTrail, and ISO 27001 plus SOC 2 Type II certification held by HridayamSoft Solutions. Together, these controls mean documents are protected at the application, storage, network, and organisational level — not just one of them.
Request the Full Security Assurance Pack
ISO 27001 certificate, SOC 2 report, VAPT certificate, source code review certificate, full Statement of Applicability — all available for enterprise due diligence under NDA.