Your Data, Protected: Privacy and Isolation by Design
Your fleet's documents are your company's data. Here is how one customer's data stays out of another's reach, who inside your company sees what, and exactly when a driver's-licence photo disappears.
Between companies: isolation enforced underneath every query
What matters in a multi-company product is not whether isolation exists but where the guarantee lives. In DocVigia it is structural: every company-scoped table gets a company filter attached automatically at the database session, for every read, rather than trusting each of dozens of screens to remember it.
- Reads are filtered underneath the code. A screen that forgot to filter by company still cannot leak across companies — the filter is added before the query runs.
- Writes are stamped automatically. A new row's company is taken from who is logged in, not from what the request says.
- Exceptions are named, not accidental. A login lookup has to check every company's users by definition; that is an explicit exception, and so are background jobs and platform administration.
- It is tested on every change. DocVigia's own end-to-end suite runs a dedicated isolation phase — a second company is checked against lists, reads and writes — before anything ships.
Inside your company: sites and roles
Company isolation decides what a whole company can see. Inside that, a user only sees the distribution centres they are assigned to — gate log, inspections, fines and reports all narrow the same way. Roles and their permissions are a matrix your administrator edits, and a role with no defined scope defaults to the user's own centres, not to everything.
The driver's licence: deleted the moment it has been read
A licence carries a person's identity. For that one document type, the image does not wait for the confirmation step: it is deleted as soon as OCR extraction returns, in the same call, before the confirmation screen loads.
This is a licence-only rule. A policy, a circulation card or a plate photo keeps its image normally — the rule targets the one document that carries a person's identity fields. It applies whatever the source: phone, ZIP or SharePoint.
Your data stays yours
An export is a button — including on the way out. Documents, dates, the gate log and reports export from the product at any time. If you leave, your data remains available to export for thirty days after the account ends. DocVigia's privacy notice states the responsible party, the purposes, the processors we use, retention periods and your rights under Mexico's LFPDPPP; the terms of service state that the data is yours.
What we do not claim
DocVigia does not currently hold an ISO 27001 or SOC 2 certification. The mechanisms on this page are what is built and tested; for a procurement review we will go into more detail than a public page should — write to support@docvigia.com.
Questions about privacy
Can one company ever read another company's data?
Not through any of the ordinary paths a user or the app goes through — every one of those gets the automatic company filter. The named exceptions (login lookup, background jobs, platform administration) are explicit and intentional.
Where is the data stored?
On cloud infrastructure operated by the processors listed in the privacy notice. The notice names each category of processor — hosting, email, OCR and language models, payments — and what each one receives.
Who can see a driver's expiry date inside my company?
Whoever your role matrix allows — typically HR and the people who need the unit status. The identity fields are not in the system at all, so the question is only about the date.