Controls for Compliance Review
Choose who can use documents, review recorded activity and set how long records stay. Check these tools against the rules that apply to your organisation.
These are evaluation topics, not certifications. Software alone does not make you compliant. Your policies, staff, legal advice and system setup still matter.
These descriptions come from the October 2026 product assessment and limited code tests, not a live end-to-end demonstration or certification. Ask to see the controls you need working in your proposed system.
Existing interface image for orientation. Framework names, status labels and stamps are not compliance certifications or proof of a tested deployment. Check the current descriptions and configuration limits.
Existing interface image for orientation only. Framework labels in the image are not certification or evidence of a tested deployment; use the qualified descriptions below.
Data Privacy & Protection
Kenya Data Protection Act (KDPA 2019)Primary framework for Kenya
Access controls, recorded activity and configured retention can support personal-data handling policies. The supplied assessment does not establish complete DSAR handling, statutory timers or ODPC compliance; confirm applicable obligations independently.
General Data Protection Regulation (GDPR)
Evaluate document access, retention and permitted exports against your processing obligations. Complete data-subject rights fulfilment and erasure across backups were not established.
California Consumer Privacy Act (CCPA/CPRA)
Assess applicability and required request-handling procedures with your advisers. The supplied dossier does not verify a complete CCPA/CPRA rights-management process or response-deadline service.
HIPAA
Class and document access controls and available audit evidence may support an assessment. They do not establish HIPAA compliance, clinical-system suitability or deployment-specific security safeguards.
PCI DSS
Evaluate access controls and recorded activity within your PCI scope. Universal access logging, requirement conformity and a validated cardholder-data environment were not established.
Consent Management (GDPR Art. 6-7 / KDPA Sec. 32)
Confirm lawful basis, consent evidence and withdrawal handling for your process. The supplied assessment does not establish an end-to-end consent-management capability.
External Data Collection via Forms (GDPR Art. 13-14 / KDPA Sec. 25-28)
Before collecting personal data, verify notices, permissions, retention and rights-handling procedures for the configured form. These outcomes were not verified by the supplied product assessment.
Sub-processor Management and Notice (GDPR Art. 28(2) / KDPA Sec. 42)
Request the current deployment-specific sub-processor information and agreed change-notice process. An always-current published list and automatic advance notices were not established by the dossier.
Privacy by Design: Custom Domain (GDPR Art. 25 / KDPA Sec. 25)
Evaluate domain configuration, transport security and recipient-facing links in your deployment. A custom domain alone does not establish privacy-by-design compliance.
Records Management
ISO 15489: Records Management
Evaluate file plans, record states, configured retention and holds against your records policy. Application controls and destroyed-record entries are not ISO conformity or certified destruction evidence.
Kenya National Archives Guidelines (KNA)
Configure classification and retention using independently approved schedules. The dossier does not establish KNA-approved schemes, automatic archival transfer or a complete statutory records regime.
DoD 5015.02: Electronic Records Management
Draft, Active Record, Semi-Active, Archived and Destroyed states are implemented. This does not establish DoD certification or full conformity with the standard.
SEC Rule 17a-4: Financial Records Retention
Application record protections and retention settings are not proof of certified non-rewriteable, non-erasable storage or SEC conformity. Verify storage behaviour, preservation and the applicable retention period independently.
Automated Retention & Lifecycle
Configured processing skips permanent policies and excludes held documents, vital records and active records. The storage path rechecks legal holds. Archived is a state, not external transfer; physical erasure across storage, backups and replicas remains unverified.
Information Security
ISO/IEC 27001:2022
Access controls and available audit evidence may contribute to an information-security assessment. Certification, a complete management system and deployment-specific encryption coverage were not established.
SOC 2 Type II Evaluation
Request a scoped controls assessment and any applicable independent report. Source inspection of document controls does not establish SOC 2 readiness or operating effectiveness over time.
NIST SP 800-53: Security Controls
Map implemented access checks and available audit evidence to your selected controls. A full NIST control assessment was not supplied.
NIST SP 800-63B: Digital Identity
Evaluate password policies, account lockout, second-factor verification, session management and recovery procedures in your deployment. The supplied dossier does not establish NIST conformity or an end-to-end sign-in or account-recovery test.
NIST SP 800-61: Incident Handling
Evaluate incident ownership, investigation procedures and supporting document evidence. A complete operational incident-response process was not verified.
NIST SP 800-61: Security Incident Handling
Available audit records may support an investigation. The dossier does not establish detection of every incident or a complete evidence trail across all response stages.
Multi-Factor Authentication
Optional second-factor sign-in supports per-user configuration and a one-time email code fallback. Verify account coverage and recovery procedures in your deployment; the supplied dossier is not an end-to-end sign-in or account-recovery test.
Explore Multi-Factor AuthenticationSecure Integrations & Webhook Security
Evaluate current endpoints, credentials, scopes and delivery verification for each enabled integration. The dossier does not establish successful webhook delivery or logging of every integration event.
Audit Log Retention & Disposition
Hash-linked records and integrity checks support tamper evidence. Retention and re-anchoring mean indefinite preservation must not be assumed; confirm coverage, export scope and preservation arrangements for your obligations.
Encryption & Cryptography
FIPS 140-2: Cryptographic Standards
No validated cryptographic-module evidence was supplied. Request the applicable module validation and deployment details before making a FIPS conformity claim.
NIST Key Management Guidelines
Assess key generation, storage, access, rotation and recovery for the selected deployment. The supplied dossier does not verify the complete key lifecycle.
Data Encryption at Rest
Confirm encryption coverage for documents, metadata, backups and transport in your chosen environment. The product assessment does not prove all-file encryption or independently verified document authenticity.
Encryption Key Lifecycle Management (NIST SP 800-57 / ISO 27001 A.10.1.2 / PCI DSS 3.6)
Request evidence of rotation procedures, recovery tests and available key-management records. Automatic rotation, uninterrupted service and complete event logging were not established.
Electronic Signatures
Kenya Information & Communications Act
Electronic signing and self-issued seals provide supporting evidence, not proof of legally advanced signatures. Assess the document, execution formalities and signing process under applicable Kenyan law.
Explore Kenya Information & Communications ActeIDAS: EU Electronic Identification
SIMPLE and ADVANCED are application evidence classifications, not verified eIDAS status. Dockria does not issue Qualified signatures on its own; qualified-provider, certificate and device evidence require separate assessment.
ESIGN Act: US Electronic Signatures
Where US law applies, assess consent, attribution, record access and required formalities. Recorded signing context does not guarantee enforceability or independent identity verification.
FDA 21 CFR Part 11
For applicable life-sciences records, assess system validation, procedures, identity controls and evidence retention separately. Document signing features do not establish Part 11 conformity.
Legal & eDiscovery
EDRM: Electronic Discovery Reference Model
Search, review, authorised holds and permitted exports may support document handling. A complete eDiscovery lifecycle, defensible production process or court-accepted output was not established.
Federal Rules of Civil Procedure (FRCP)
Authorised holds restrict supported modification and disposal actions. Preservation scope, legal sufficiency and actual deployment/storage behaviour require separate assessment.
Access Governance
SOX Section 404: Internal Controls
Configured access checks and recorded activity can support internal-control review. They do not prove segregation of duties or SOX control effectiveness.
ISO 27001 A.9.2.5: Access Rights Review
Evaluate effective permissions and revocation as part of your review procedure. The dossier does not establish a completed access-certification campaign or conformity assessment.
Role-Based Access Control (RBAC)
Class, document, workflow and administrative permissions govern supported actions. Test intended allow/deny cases and revocation; revocation cannot recall copies already downloaded.
AI & Automation Governance
Human-in-the-Loop AI Controls
AI can propose metadata for review or apply it under configured rules. Not every suggestion requires manual review; eligibility, configuration and processing outcomes matter.
Confidence-Based Auto-Confirm Policies
Configured thresholds and apply guards affect whether output is proposed or applied. Isolated decision-logic tests were reported, not a deployed AI integration or accuracy guarantee.
AI Decision Audit Trail
Review available processing and activity evidence. Exhaustive logging of every suggestion and decision was not established; verify required event coverage in your deployment.
ISO/IEC 42001: AI Management System Evaluation
Evaluate AI configuration, human review and available evidence against your governance policy. The supplied assessment is not an ISO/IEC 42001 conformity assessment or certification.
Explore document-control scenarios for your industry
Compliance-critical features
Need to evaluate specific controls?
Discuss your required controls and request deployment-specific evidence. Confirm event coverage, access rules, retention behaviour and storage arrangements before relying on them.
Request a Compliance Demo