Trust Center

A starting point for security review: implemented controls, explicit boundaries, declared subprocessors, and vulnerability reporting.

Security posture

• Database-backed tenant isolation. Tenant-scoped tables use Postgres FORCE ROW LEVEL SECURITY, and the committed test harness exercises cross-tenant probes as a non-owner application role. Application authorization remains an additional layer rather than the only boundary.
• EU data-at-rest for the core data plane. Core content and tenant stores are configured in EU regions. 12 of 17 declared rows are EU-resident; 5 non-EU carve-outs cover services such as authentication, payments, and consented acquisition analytics. This is not a claim of EU-only edge processing.
• Content security and framing controls are surface-specific. This marketing site ships a build-time hash policy without unsafe-inline script, while frame-ancestors none is delivered in its HTTP response header. Dashboard and portal policies are tested separately; we do not claim that every first-party surface has an identical style policy.
• Immutable release artifacts with explicit activation. The publishing path writes content-addressed release artifacts and activates a selected release through a pointer. That makes rollback deterministic, but it does not turn the design into a guarantee that every edge, storage, or operational outage is impossible.
• Crypto-shred erasure with proof gates. The implemented erasure flow destroys the scoped data-encryption key, reconciles every declared store, and emits a completion receipt only after clean verification. Production assurance still depends on configured adapters and an end-to-end operational receipt.
• Auditable staff-access paths. Supported staff impersonation sessions and back-office actions are written to audited tables and projected into the customer activity feed. We do not treat an audit row as a substitute for access policy, review, or incident response.

Data residency

EU data-at-rest by construction; US carve-outs are disclosed rows, never hidden (docs 04/19/34).

The full, CI-gated subprocessor and residency table is published at /trust/subprocessors/. Dependencies matching the manifest's vendor markers cannot pass the trust-surface gate without a disclosed row. Contract and infrastructure review cover data flows that a package marker cannot detect.

Compliance

Doctorine is not currently claiming SOC 2 certification. The control scaffold exists; an audit report remains post-GA work. We act as processor for customer workspace content under the applicable DPA, with transfer bases disclosed for non-EU subprocessors. Incident tooling defines a 48-hour customer-notification target, but the automated breach clock and delivery receipt remain rollout work; executed customer terms govern.

Report a vulnerability

We operate a responsible-disclosure policy with safe harbor: /trust/security/, machine-readable at /.well-known/security.txt (RFC 9116). Email security@doctorine.xyz.