Security & data handling

Private files and account access

Saved evidence is held in private file storage. Requests for originals, previews and saved reports require a verified, signed-in account and are checked against the owner. The application does not issue public evidence URLs. Keep your password private, use a unique password and sign out on shared devices.

What processing involves

Files are validated against supported formats and upload limits. Extraction and AI analysis can create page images, text and other derived material. AI-assisted checks may send relevant content to an external AI provider. Private account storage does not mean all processing occurs on your device.

Hosted analysis is restricted to approved testing, and customer document checking remains closed. Each hosted check uses a temporary isolated environment with restricted network access, bounded resources and a time limit. Server service credentials remain outside that environment. Do not submit privileged or regulated evidence without first agreeing the required safeguards with us.

Controls and their limits

The application checks ownership on saved-file operations, restricts server credentials to server use, applies upload and storage limits, and separates review acknowledgements from analysis results. Hosted background workflows receive job identifiers rather than document contents. Routine application logs use job identifiers, statuses and bounded error details; provider-managed records and temporary analysis workspaces can have different data and retention. These are application controls, not an independent security certification.

We do not claim SOC 2 or ISO 27001 certification, end-to-end encryption, Singapore-only residency, a completed penetration test, zero provider retention or guaranteed recovery. Availability, backup requirements, provider settings and contractual safeguards must be assessed for your use case.

Protect your evidence

Keep your own authoritative originals, backups and evidence-handling records. Redact information that is unnecessary for a check where doing so will not compromise your review. Export findings you need to retain. An automated report is not a certified forensic examination or proof that a source has not been altered.

Report a security concern

Email info@pwkholdings.com with the subject “DocSpotCheck security report”. Include the affected page, approximate time and non-sensitive reproduction steps. Do not send passwords, access tokens, client documents or other people’s personal data. Ask us for a suitable transfer method if evidence is needed.

Do not access another person’s files, extract data, disrupt the service or perform intrusive testing. Contact us for written authorisation before any security testing. Reporting a concern does not by itself authorise testing or create a bug-bounty arrangement.