Security

Where we are today

Thinking Signal is an early-stage company and AutoDocxy AI is in evaluation with its first users. This page describes controls that are actually in place, and says plainly where a control is planned rather than built. We would rather lose a deal on this page than win one on a claim we cannot evidence.

We hold no SOC 2 report and no ISO 27001 certificate, and we have not completed an independent penetration test. If your procurement process requires either, tell us early and we will tell you honestly whether the timeline works.

Access and authentication

• The document workspace sits behind authentication; no document screen is reachable without a session.
• Operator-only controls, including the reset and connector switches, are refused to a normal workspace session.
• Lead and contact records are readable only through an authenticated session or a server-side token.
• Workspace accounts are issued per person for an evaluation and revoked when it ends.

Data protection

• All traffic to the website and the workspace is served over HTTPS.
• Uploads are constrained by type and size, and each document is stored against its own identifier.
• Source documents are retained alongside extracted values so a reviewer can always check a field against its origin.
• Evaluation data is deleted within 30 days of the evaluation ending, or sooner on request.

Human control points

The product is built so that automation cannot quietly commit a record. These are properties of the workflow, not settings an operator can switch off in passing.

• A document cannot reach posting without passing validation and matching, or a review that resolved the blocking exception.
• Low-confidence values and ambiguous classifications stop with a person rather than being forced into the nearest match.
• Every mapping, correction, approval, rejection and sync is written to an audit trail with its actor and timestamp.
• A failure on one document never silently posts or blocks an unrelated document in the same batch.

Demonstration boundary

The ERP records shown in demonstrations are simulated. AutoDocxy AI does not write back to a live SAP, Oracle or Maximo system during an evaluation. A production connector is a separate, explicitly agreed step with its own credentials, its own testing and your own change control.

Infrastructure and subprocessors

• The public website and its enquiry records run on Cloudflare.
• Our own email runs on Hostinger.
• Document extraction may call a configured AI model provider, named to you before your evaluation begins.
• A deployment inside your own network or region can be discussed where residency requires it.

Reporting a vulnerability

Email security@thinkingsignal.online with enough detail to reproduce the issue. We will acknowledge within three working days and keep you updated until it is resolved. Please give us a reasonable window to fix an issue before publishing it. We will not pursue anyone who reports a genuine finding in good faith.