Most document AI security pages describe how carefully a vendor guards your data after you have sent it to them. DocxIntel removes that step. The platform, the models and the keys sit inside your infrastructure, so the controls your auditors already trust are the controls that apply.
These are architectural properties, not policy commitments — they hold because there is no vendor-side service for your data to reach, in any deployment model including private cloud and managed single-tenant.
A cloud document service can encrypt in transit, isolate tenants, rotate keys and publish an attestation, and all of it can still be undone by one misconfigured bucket, one over-broad support role or one subprocessor change buried in a policy update. Removing the network path removes the entire class of failure rather than mitigating it.
This is also why the security review during a Proof of Value is conducted against the deployed system in your own environment, rather than against a questionnaire about ours.
The controls a security team asks about first, described as they are implemented rather than as they are aspired to. The full pack, including the framework mapping, is available under NDA.
Control implementation for a specific release is evidenced in the security pack and verified against the deployed system during a Proof of Value, not asserted on a marketing page.
Every vendor says it does not exfiltrate your data. The useful question is whether the claim is testable in an afternoon. This one is.
Apply a network policy that blocks all outbound traffic from the DocxIntel namespace, then process documents. Nothing degrades. There is no retry queue waiting for connectivity and no feature that quietly stops working.
Monitor the perimeter with your existing tooling for the duration of a Proof of Value. The expected result is zero outbound connections attributable to DocxIntel — no analytics beacon, no error reporter, no model download.
The air-gapped deployment model is the control experiment. The bundle arrives on physical media, installs offline and produces identical output, which is only possible if nothing depends on reaching us.
How air-gapped installs workNo call-home activation, no heartbeat, no remote kill switch. Licence validation is performed locally against a signed artefact, so a network outage or a lapsed connection cannot stop document processing.
Weights are delivered in the bundle and mounted from local or cluster storage. No component pulls from an external model registry at runtime, so inference cannot fall back to a hosted endpoint under load.
What's in the boxSupport bundles are generated locally for you to inspect and redact before sharing. Nothing is transmitted automatically, and no crash reporter or usage analytics agent is included in any image.
Removing the network path handles data exposure. It does not handle the software you install, which is why the build pipeline and the patch cadence are the parts of this page worth reading twice.
Ask for the security pack before the Proof of Value rather than after it. Your security team reviewing week one in parallel with deployment is the difference between a 45-day evaluation and a six-month one.
DocxIntel is not a compliance product and cannot make your organisation compliant. What it can do is remove the hardest obligation to satisfy — an external processor holding regulated documents — so the remaining work is inside your existing control environment.
Central Bank of the UAE expectations around outsourcing arrangements, data residency and supervisory access are far simpler to evidence when no outsourced processing occurs. Documents are processed on infrastructure inside your own regulated estate, so your residency position is the deployment diagram and your regulator can inspect the system in place.
Cross-border transfer, processor obligations and data-subject rights all get easier when there is no processor and no transfer. Personal data stays within your controlled environment, retention and deletion run through your storage lifecycle, and access is governed by your identity provider and your RBAC.
Health data localisation requirements are met by locating the processing, not by contracting around it. Clinical documents — handwritten prescriptions, admission forms, insurance claims — are analysed inside the facility or the payer network that already holds them, with field-level provenance available for clinical audit.
Where GDPR applies, DocxIntel supports data minimisation, purpose limitation and storage limitation because you configure all three, and supports Article 15 and 17 requests through your own storage and audit tooling. There is no Chapter V transfer analysis to perform, because personal data does not leave your infrastructure.
It would be easy to put a row of framework badges on this page. We are not going to, because DocxIntel is a new product and badges we have not earned would be the least trustworthy thing on a security page.
DocxIntel and BizfyLabs hold no SOC 2 report, no ISO/IEC 27001 certificate and no other third-party security certification. Any vendor page implying otherwise about us is wrong, and any vendor implying it about themselves is worth asking for the report and the scope statement.
Controls designed against the SOC 2 Trust Services Criteria and mapped to the ISO/IEC 27001 Annex A control set, documented in a security pack with architecture diagrams, data-flow diagrams, the threat model, the SBOM and the vulnerability-handling process. Available under NDA on request.
Request the packBecause DocxIntel runs inside your environment, it falls within the scope of the certification you already hold rather than requiring you to inherit assurance from us. Your access controls, encryption, logging, change management and retention evidence apply to it directly — which is a stronger position than a vendor attestation about a system you cannot inspect.
Direct answers, including the ones where the answer is no.
No, and we will not imply otherwise. DocxIntel is a new product and holds no third-party security certification. What we do is build and document controls designed against the SOC 2 Trust Services Criteria and the ISO/IEC 27001 Annex A control set, and ship a system that runs entirely inside your certified environment — so the platform sits within the scope of your certification rather than asking you to inherit ours. The security pack, including the control mapping, is available under NDA on request.
Architecture and data-flow diagrams, the control mapping, the threat model, the SBOM and the vulnerability-handling process, available under NDA. Send it to your security team before the Proof of Value, not after.
