Privacy Policy & Data Protection

DocuVerified operates as an authoritative cryptographic trust layer for official business documents. Traditional verification workflows force organizations to email unredacted PDF files or photocopies containing sensitive employee details—such as passport numbers, national ID numbers, and confidential compensation figures—to third parties such as commercial banks, embassy visa officers, landlords, and background-check agencies.

Our platform replaces this vulnerability with Privacy-by-Design architecture. When an organization issues a document through DocuVerified, our cryptographic engine binds the document to an opaque verification token (e.g. DV-26-X7M9KP) and a mathematical SHA-256 checksum. Third-party verifiers can confirm whether the document was legitimately issued, whether it remains valid, and whether the file has been tampered with—without seeing confidential data points that the issuer has chosen to mask.

We collect and process only the minimal data required to issue, manage, and verify official corporate documents:

• Account & Organization Information: Corporate legal entity name, commercial trade registration or tax registration number (TRN), registered business address, authorized signatory name, corporate email address, and billing contact.
• Cryptographic Document Metadata: Document category (e.g. Salary Certificate, NOC Letter, Offer Letter), issuance timestamp, unique alphanumeric verification ID, document status (Valid, Revoked, Expired), and the SHA-256 cryptographic hash of the generated PDF document.
• Authorized Recipient Identifiers: Recipient name and professional designation as specified by the issuing company.
• Verification Activity Logs: When a verifier scans an embedded QR code or enters a token on the public portal, we record the verification timestamp, IP address (truncated and anonymized for fraud prevention), and browser user-agent string to maintain an audit trail for the issuer.

DocuVerified provides granular Field-Level Privacy Controls. Issuing organizations can configure exactly which fields are visible on the public verification portal when an external third party scans the document’s QR code:

When a field is flagged as masked, the raw value is never stored in plain text on the public-facing verification lookup service.

DocuVerified uses collected information strictly for operational and verification purposes:

• To render and generate official corporate documents formatted according to enterprise standards.
• To maintain the authoritative cryptographic ledger that powers instantaneous QR code verification for third-party verifiers (banks, embassies, universities, immigration authorities).
• To notify issuers when a revoked or expired document is queried or flagged for suspicious activity.
• To generate administrative analytics for enterprise account holders (e.g. issuance volume, document lifecycles, verification counts).

Under the European Union General Data Protection Regulation (GDPR) and equivalent international data protection frameworks, we process your information under the following legal bases:

• Performance of a Contract (Article 6(1)(b) GDPR): Processing is necessary to provide the DocuVerified software platform, issue official requested certificates, and deliver cryptographic verification services to our subscribers.
• Legitimate Interests (Article 6(1)(f) GDPR): Maintaining platform security, preventing fraudulent document duplication, defending against malicious tampering, and logging verification attempts.
• Legal Obligation (Article 6(1)(c) GDPR): Complying with statutory accounting requirements, tax retention rules, and lawful requests from competent courts or regulatory bodies.

We enforce rigorous technical and organizational security controls across our infrastructure:

We retain document metadata for as long as the issuing organization maintains an active subscription or until the issuer explicitly marks a document as Revoked or Purged:

• Active Documents: Verifiable indefinitely or until an optional expiration date configured by the issuer.
• Revoked Documents: If an employee leaves or a certificate is cancelled, the issuer marks the record Revoked. Any subsequent scan of the QR code immediately displays a prominent "Revoked" status.
• Account Deletion / Data Purge: When an enterprise closes its account, all corresponding document templates and metadata are scheduled for permanent, irreversible cryptographic purging within 30 days.

Depending on your geographical jurisdiction, you possess statutory rights regarding personal data held about you:

To exercise any of these rights, contact our Data Protection Officer at privacy@docuverified.com. We respond to all verified requests within 30 days.

DocuVerified engages select Tier-4 infrastructure providers who comply with SOC 2 Type II, ISO 27001, and GDPR Data Processing Addendums:

If you have questions, regulatory inquiries, or concerns regarding our privacy policies or data processing practices, please contact our Data Protection Officer: