Docontrol Trust Center

generated: '2026-09-06'
method: searched
probe: true
source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
url: https://www.docontrol.io/security
description: >-
  Certifications read from DoControl's own documentation page, which names them in plain text.
  This file was briefly overwritten on 2026-09-06 by an automated keyword probe that could only
  see HIPAA and GDPR — the marketing /security page is a JS-rendered Webflow page whose
  certification copy is not in the served HTML, so the probe found less than DoControl actually
  publishes. The documentation page is the stronger source and is used here.
certifications:
- id: iso-27001
  name: ISO 27001
  evidence: 'Documentation states: "Compliance certifications (ISO 27001, SOC2 type II)"'
  source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
- id: soc2-type-ii
  name: SOC 2 Type II
  evidence: 'Documentation states: "Compliance certifications (ISO 27001, SOC2 type II)"'
  source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
- id: hipaa
  name: HIPAA
  evidence: HIPAA compliance claimed on the DoControl website.
  source: https://www.docontrol.io/
- id: gdpr
  name: GDPR
  evidence: GDPR readiness claimed on the DoControl website.
  source: https://www.docontrol.io/
programme:
  page: https://www.docontrol.io/security
  page_status: 200
  page_machine_readable: false
  page_note: >-
    Webflow, client-rendered. HTTP 200 and 120KB of HTML, but the certification names are not in
    the served markup — a crawler reading only the response body sees none of them.
  contact: security@docontrol.io
  practices:
  - Penetration testing
  - Publicly available self-assessments
  - Data processing addendum
  - Information Security Policy
  data_handling:
    llm_use_disclosed: true
    llm_statement: >-
      DoControl discloses that it uses LLMs for global search, alerts and its Dot assistant, that
      the models are hosted inside DoControl's own environment with no internet access, and that
      customer data is never sent to, stored by, or used to train any external LLM or AI service.
    source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
trust_center:
  dedicated_portal: false
  note: >-
    No Vanta/Drata/SafeBase-style trust portal; trust.docontrol.io does not resolve. Evidence is a
    marketing page plus a documentation page, with no downloadable report index.
evidence:
- source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
  status: 200
  keywords:
  - iso 27001
  - soc2 type ii
  - penetration testing
  - self-assessments
  - data processing addendum
- source: https://www.docontrol.io/
  status: 200
  keywords:
  - hipaa
  - gdpr