Built to be trusted with the ledger.
Finance data deserves more than a checkbox. DocQex isolates every tenant at every layer, federates identity, separates duties, and keeps an append-only record of everything that matters.
One subdomain. One security boundary.
Every customer is a tenant reached through its own subdomain, such as acme.docqex.com. Before a request touches data, it is bound to exactly one tenant — and that boundary travels with the record wherever it goes.
Automated negative tests prove isolation across APIs, files, caches, jobs, exports, search, and notifications.
- Step 1
The edge accepts only known hosts
Configured DocQex subdomains or verified custom domains — anything else is refused.
- Step 2
The host resolves to one active tenant
Unknown, suspended, or mismatched hosts fail closed and never fall back to another tenant.
- Step 3
Your identity provider authenticates the person
OIDC Authorization Code with PKCE. DocQex never stores passwords.
- Step 4
DocQex validates an active membership
Roles, attributes, and status are evaluated for this tenant only.
- Step 5
Tenant context is set for the request
Derived from the host and membership — never from a client-editable field.
- Step 6
Access is enforced twice, independently
Application authorization and forced PostgreSQL row-level security.
- Step 7
The boundary follows the data
Audit, events, files, caches, jobs, and responses keep the same tenant context.
The right people, and only them.
Backend authorization is authoritative: hidden buttons are never a substitute for server enforcement, and every identifier is treated as untrusted.
Single sign-on
OIDC and SAML federation through your identity provider, with secure, HttpOnly, host-only sessions.
Mandatory MFA
Required for tenant administrators, finance-release roles, platform operators, and support sessions.
Roles and attributes
Ten built-in roles plus attribute rules by entity, branch, department, project, amount, and ownership.
Segregation of duties
Self-approval, requester-as-payer, and bank-detail-change-and-release conflicts are blocked.
Sensitive by default, exposed by exception.
Encrypted everywhere
TLS in transit; sensitive values and documents encrypted at rest with managed keys and rotation.
Masked by default
Bank details, tax IDs, secrets, and document contents are masked and excluded from logs and telemetry.
Quarantined uploads
Files are validated and scanned before they can ever become downloadable business evidence.
Privacy workflows
Export, correction, retention, legal hold, and verified deletion support your privacy obligations.
Every material change, on the record.
Audit events are append-only and capture the tenant, actor, acting-for context, request, target, and a redacted change set. High-risk events are tamper-evident and exportable with integrity metadata.
- Policy version recorded with every evaluation
- Seven-year default retention, configurable upward, with legal hold
- Support access is time-limited, purpose-bound, and fully audited
- Priya Raman Approved payment runPAY-UK-0412 · £172,335.69
- Policy engine Evaluated reportRPT-26-0318 · Travel v4 · within policy
- Daniel Okafor Changed vendor bank accountCompass Group · ••••4410 · pending 2nd approval
- Integration Exported batchGL-EXP-1187 · 214 lines · totals reconciled
- Marcus Lee Delegated approvalsTo Elena Petrova · until 24 Oct
Available when close is due. Resident where you need it.
DocQex runs in deployment cells. Tenants with residency requirements are assigned to an approved regional cell — services, database, storage, search, queues, backups, and support operations stay in that region.
- Monthly availability target
- 99.9%
- Recovery point objective
- 15min
- Recovery time objective
- 4hrs
- Restore exercises, minimum
- 2×yearly
Regional cells
Tenants are pinned to one approved cell; any transfer requires an audited approval.
Tenant-scoped recovery
Backups restore the platform and can produce a tenant-scoped export without exposing anyone else.
Fair-share capacity
Quotas and noisy-neighbor controls keep one tenant’s month-end from slowing another’s.
Governed AI
AI may extract, classify, summarize, and recommend — never approve, pay, post, or alter records on its own. Retrieval enforces tenant and field permissions, every interaction is auditable, and tenant data is never used to train shared models without explicit contractual opt-in.
Compliance readiness
Controls are mapped to support SOC 2 and ISO 27001 evidence, with threat modeling, dependency and container scanning, and independent penetration testing as release gates. Jurisdiction-specific obligations such as GDPR, DPDP, and PCI DSS are assessed with your legal team.
Found a vulnerability? Please report it privately to security@docqex.com. We acknowledge reports promptly and keep reporters informed through remediation.
Bring your security team. We’ll bring the evidence.
Walk through tenant isolation, identity, audit, and residency with the engineers who built them — and leave with our architecture and controls pack.
- 45 minutesTailored to your workflows
- Product specialistsNo scripted sales pitch
- Security review readyArchitecture and controls pack