DOXIO

Every step with a document is recorded and can be checked

DOXIO is built on a short list of rules. The code and the database enforce them, tests guard them and security reviews probe them.

Data processing agreement

Hash-chained audit trail

Every event carries the fingerprint of the one before it. Records can only be added, and the database itself blocks any rewrite of history, so tampering shows.

  1. 41document.created

    000000… → a41f0c…

  2. 42document.shared

    a41f0c… → 7be2d9…

  3. 43share.otp_verified

    7be2d9… → c0938e…

  4. 44document.signed

    c0938e… → e51b47…

Sample of four records for one document. Fingerprints are shortened.

What the signature certificate contains

The certificate is attached to the end of the signed PDF. From Tým you can also get it as a separate file.

Document
The SHA-256 fingerprint of exactly the version the signer saw and signed.
Signer
Name and the email address the signer confirmed with a one-time code.
Time, IP address and device
When, from where and in which browser the signature happened, for each signer separately.
Filled-in fields
Values of the fields filled in by the sender and the signer, with their own fingerprint.
Signing order
Whether signers went one after another in a fixed order or signed in parallel.
Legal statement
A statement that this is a simple electronic signature under the eIDAS regulation.

Rules that hold without exception

Strict tenant isolation
Every query is scoped to your organization from a server-validated session with a membership re-check. A client can never reach another tenant's data.
Hashed secrets & OTP access
Share tokens and one-time codes are stored only as hashes and compared in constant time. External access always requires a fresh emailed code.
No raw file URLs
External recipients receive bytes only through a share-scoped, rate-limited stream. We never hand out raw or presigned object URLs.
Version-pinned, immutable signing
The signer signs the exact shared version, verified by checksum. Signing is transactional and race-safe; the signed copy can't be altered or rolled back.
Append-only audit log
A per-organization, hash-chained audit trail makes any tampering evident. The log can only ever be appended to, enforced by a database trigger.
Verified billing & strict CSP
Entitlements flip only on cryptographically-verified payment webhooks. A nonce-based Content-Security-Policy locks down what can run in the browser.

How DOXIO uses AI

Document extraction is an optional module that reads invoices and receipts and pre-fills the accounting record. These rules apply to it.

Off until the owner switches it on
The module is off for every organization. Only the owner can switch it on, after accepting a consent text; we record which version was accepted, by whom and when. It can be switched off at any time.
Processing in the EU
Documents are processed by Mistral AI in France, in the European Union. In production we use a paid plan with a data-processing agreement and model training on customer data switched off.
No public links
The file travels inside the encrypted request (base64 over TLS). We never create a public link to your document. We keep the extracted values, not the full recognised text.
Page limits
Only a limited number of pages of each document is read, and every organization has a monthly page limit. That keeps both cost and the amount of data sent under control.
A person confirms every value
Extracted values are a draft until someone in your organization checks and confirms them. AI never overwrites data from ISDOC, a QR payment code or manual entry.
Audit log without content
Switching the module on or off and every extraction are written to the audit log: who, when, how many pages and the outcome. The log never contains document content.

What kind of signature DOXIO creates

A DOXIO signature is a simple electronic signature under the eIDAS regulation (EU) No 910/2014: a visible signature in the document backed by a full audit trail. It is not a qualified electronic signature (QES) and not a PAdES cryptographic signature. That is enough for most business agreements. If the law or the other party requires a qualified signature, consult your lawyer.

Infrastructure

DOXIO runs on Railway in EU regions. The PostgreSQL database and file storage are in the EU and access is least-privilege. Payments are handled by Stripe, email by Resend.

View our sub-processors