Security

Our posture

Access to the product is invitation-only. Roles are scoped per knowledge base, so a collaborator only sees what they were given access to. Secrets (provider keys, webhook headers) are stored encrypted, never in plain text or in logs.

Every MCP link carries its own audit trail (who, when, what) with a 90-day retention. Backups are taken regularly and restore is tested. We maintain a security posture profile aligned to NIST CSF 2.0 in our repository, publicly documented.

Reporting a vulnerability

Write to support@doctiling.app with the details you have (steps to reproduce, affected endpoint, impact). We acknowledge receipt within 2 business days.

We follow coordinated disclosure: please do not disclose a vulnerability publicly before we have shipped a fix or 90 days have passed since your report, whichever comes first.

Incident commitment

If a security incident affects your data, we notify affected users and, where required by law, the competent authority, without undue delay.

For clients with a signed Data Processing Agreement (DPA), that notification happens within 72 hours of us becoming aware of the incident.

security.txt

The machine-readable version of this contact channel is published at https://www.doctiling.app/.well-known/security.txt.

Contact

Privacy: privacidad@doctiling.app. Security reports and general support: support@doctiling.app.

Validity and last update

This page is in force and was last updated on 2026-10-08.