Security
Your documents never reach us, because there is no us
DocuSanad is a SharePoint Framework solution. It runs in the browser, inside your tenant, against SharePoint’s own APIs. That is an architectural fact, not a promise we are asking you to trust.
Architecture
Where everything actually lives
Application code
Served from your own SharePoint App Catalog after you install the package.
Document content
Stays in your SharePoint libraries. DocuSanad reads and writes it in place.
Metadata and audit log
Ordinary SharePoint lists on your own site, which you can inspect, export or delete.
Identity
Your Entra ID. We issue no credentials and hold no accounts.
Backups
Yours. DocuSanad adds no separate data store to back up.
Our access
None. We have no tenant, no database and no telemetry pipeline receiving your content.
Because the solution has no server component, there is no shared infrastructure between customers, no cross-tenant data path, and no incident on our side that could expose your documents. Your data residency is whatever your Microsoft 365 tenant’s residency already is.
Being precise
The three places data can leave, and what controls them
Approval notification email
On by default. Disable by not using the approval workflow.Sent through SharePoint’s own mail service, from your tenant, to recipients in your tenant. The endpoint rejects external addresses by design. Nothing transits us.
Licence check
Required for paid tiers. Reads Graph usageRights with User.Read.A Microsoft Graph call that asks whether the signed-in user holds a DocuSanad seat. It sends tenant and user identifiers only — never document content, names or metadata.
AI classification, if you enable it
Off by default. Enterprise Plus only, and requires you to deploy the endpoint.Document text is sent to an endpoint you host in your own Azure subscription, using your own key. We never see it, never receive it, and are not in the request path. The proxy ships as source so you can audit exactly what it does.
Access control
SharePoint stays the enforcement point
DocuSanad resolves a role — Reader, Contributor, Approver or Administrator — from membership of four SharePoint groups, and uses it to decide which controls to render.
That is a user experience layer, not a security boundary. SharePoint remains the thing that actually enforces permissions. A Reader who forges a request still gets a 403 from SharePoint. For genuinely confidential content, set real permissions on the library — the confidentiality banding in the explorer hides documents from view, it does not protect them.
We would rather tell you this plainly than let you discover it during a penetration test.
What is recorded
The audit trail
- Uploads, with the metadata applied at the time
- Metadata changes, including bulk edits
- Approval requests and decisions, with comments
- Downloads and previews
- Deletions, which are always to the recycle bin
- Disposition decisions, with the mandatory reason
- Provisioning and schema upgrades
The log is append-only by convention and lives in a list on your own site. Audit writes never block the work that triggered them — a failed log entry must not roll back an approval SharePoint has already committed — so the compliance view reports a gap as a gap rather than papering over it.
If you enable AI
Prefer the option that stores no secret
AI classification needs an endpoint you host. It can authenticate two ways.
Recommended
Entra ID
A token is obtained for your own resource at call time. No secret is stored anywhere.
Fallback
API key
Stored in a SharePoint list restricted to administrators. That is access control, not encryption — a site collection admin can still read it.
The setup screen says exactly this, at the moment you choose. We would rather lose a little polish than have somebody store a key without understanding where it lands.
Reporting a vulnerability
If you believe you have found a security issue in DocuSanad, email support@kamsoft.tech with enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly. We will confirm receipt and keep you updated on the fix.