Security is built into every layer of the Doctavian document generation pipeline. This page summarises the key security aspects relevant to developers integrating the API.
For quick answers to common security and compliance questions, see the FAQ.
When a generation request is triggered, your data is sent securely to the rendering engine, applied to the template in an isolated transaction, and the output document is placed in the storage destination you configured. The data exists only for the duration of that single transaction — Doctavian does not persist any business data after generation completes.
All data in transit is encrypted over HTTPS. Sensitive data at rest is protected using Always Encrypted — data is encrypted in the database and the decryption key is managed via Key Vault, accessible only to the application. No sensitive values are exposed in logs or responses.
Doctavian does not store your business data on its infrastructure. Data is consumed only in isolated, per-request transactions initiated by authenticated users. Template files and generated output documents are stored in the destination you configure — your own cloud storage. There are no logs produced from user data.
Every Doctavian API request is authenticated via a set of HTTP headers. Each header carries a distinct piece of information about who is calling, which API they are calling, and — for async operations — where the result should be delivered. See Authentication for the full breakdown of each header and how to construct them.
Multifactor authentication (MFA) is enforced on all internal infrastructure and code repository credentials.
For full details on constructing each header, see the Authentication. For authentication error codes and how to resolve them, see the Error Codes Reference.
Doctavian maintains a documented security incident response process. In the event of a breach or threat, the process covers identification, containment, remediation, and notification procedures.
If you discover a security vulnerability in the Doctavian API or developer portal, please report it through the Support Portal rather than disclosing it publicly. We aim to respond to security reports within 48 hours.