Security and data handling
For the person filling in the security questionnaire, and the administrator deciding whether to authorize the app.
This page describes what Doclayer can access, what it stores, and what happens to that data. It is written to be checked against the privacy policy and the subprocessor list, which are the binding documents.
What Doclayer can access in monday.com
The app requests seven OAuth scopes. Each one is tied to a specific action in the review workflow.
| Scope | Used for |
|---|---|
| boards:read | Verify the board and item context and read the board schema. |
| assets:read | Download only the files a user explicitly selects for review. |
| updates:read | Verify update ownership for item-scoped actions. |
| boards:write | Create reviewer-approved Issue and Question items and attach exports. |
| updates:write | Publish reviewer-approved Cited Answers or replies. |
| account:read | Bind the installation to the correct monday account. |
| me:read | Identify the OAuth user and require an account administrator for setup. |
Doclayer does not read files it has not been asked to review. Files reach Doclayer only when a user selects them in the app or uploads them directly. Writes to the board happen only for findings a reviewer has approved.
Who can do what
First-time setup for a monday account requires an account administrator, who authorizes the app once. Other users on that account then enter from the board without a separate Doclayer password. monday Viewers get a read-only view: they can open the Matrix and its Evidence, but every action that adds, runs, exports, or publishes is hidden or disabled and consumes no allowance.
Isolation and encryption
Every customer is a separate Organization in Doclayer. Documents, extracted text, indexes, Cited Answers, decisions, usage, and audit events are stored and queried under that Organization, and the app re-verifies board, item, and account ownership on the server for each request. OAuth credentials are encrypted at rest with a dedicated key-encryption key, and re-authorizing a connection replaces the stored token. Uninstalling the app removes the credential immediately.
AI processing and training
Doclayer does not use customer documents to train general-purpose AI models, and does not sell customer data or use it for advertising. Cited Answers are generated by sending the relevant passages of the selected Documents to the configured model provider, listed on the subprocessor page, with data retention by the provider disabled where the provider offers that control. Citations are bound to passages the server already holds, so an answer cannot cite text that is not in the Documents.
AI output is review assistance. The app shows the source beside every answer so the reviewer can confirm it, and marks a cell as insufficient evidence rather than guessing when the Documents do not support an answer.
Hosting
The application, database, and object storage run on Scaleway in the European Union. Website analytics use Google Analytics and load only after a visitor accepts the cookie notice.
Retention and deletion
Uninstalling the monday app disables the connection at once. All installation data, including selected source files, derived text and indexes, cited results, and installation metadata, is permanently deleted within 10 days of uninstall unless the customer gives clear written consent to a longer stated period. An organization administrator can also request deletion at any time by email; the steps are on the data deletion page.
Certifications
Doclayer does not yet hold a SOC 2 report or ISO 27001 certificate. The controls above are implemented and tested in the codebase, and the monday Marketplace review covers the app's permissions and data handling. If your procurement process needs a completed security questionnaire, email info@doclayer.ai.
Reporting a vulnerability
Email info@doclayer.ai with "Security report" in the subject line, reproducible steps, and the impact you observed. Please do not access another customer's data or disrupt the production service while investigating.