Contracts, loan files and compliance records are among the most sensitive data a business holds. Here is exactly how NDMS isolates, protects, retains and disposes of yours — written plainly, for the people who have to sign off on it.
NDMS is architected to help you meet common records, privacy and retention obligations. We are not currently independently certified against ISO 27001, SOC 2 or similar. Where we say "aligned", we mean our defaults and controls are designed to support your obligations — not that a third party has audited us. We'll tell you the same thing on a call.
Every tenant's documents, users, signatures and audit records live behind Postgres row-level security (RLS). Each query is automatically scoped to a single tenant, and the application connects as a non-privileged database role — so isolation holds even if application code has a bug. It is defence in depth, not a filter someone can forget to add.
On top of that, each tenant can carry its own KMS encryption key, so records are cryptographically separated even though they share infrastructure. One tenant's documents cannot surface in another's search, export or audit view. Ever.
NDMS deploys per-region. Your documents, database, search index and archives all live in a single AWS region — and we can stand your instance up in the region your policy or customers require (for example an EU or Asia-Pacific region). Your data does not fan out across regions for storage or processing.
Everything you see in the console is served over HTTPS/TLS, and documents are stored encrypted at rest in object storage — optionally under a per-tenant KMS key. Uploads and downloads use short-lived, signed URLs scoped to your tenant, never a public path.
Records don't just pile up. You attach a retention policy — how long a document stays active, how long it's archived, and what happens at the end (delete, anonymise, or legal hold). NDMS runs that schedule for you: it transitions aged documents to cold storage and disposes them when their window truly elapses.
Archived records are written to S3 Object Lock (WORM) in compliance mode — they cannot be altered or deleted before the retention period ends, not even by an administrator. That's the difference between "we have a policy" and "the storage physically enforces it."
Every meaningful action — a view, an edit, a signature, an archival, a disposal — is written to an append-only audit log with the actor, the time and the tenant. When someone asks "who could see this, and what happened to it?", you answer from the record, not from memory.
There are no passwords to phish, leak or reset. Signing in takes two factors every time: a one-time code sent to your email, plus a code from your authenticator app. Access inside a tenant is governed by role-based access control, so people see only what their role allows — in live search and archives alike.
You can export your documents and, subject to any active legal hold or WORM retention window, erase records or your whole tenant on request. There's no proprietary format holding your data hostage. When you leave, your data leaves with you or is destroyed — your choice.
Row-level security per tenant, a non-privileged DB role, and optional per-tenant KMS keys.
Archived records are Object-Lock (WORM) — unchangeable until retention truly elapses.
Passwordless 2FA (email code + authenticator) and role-based access control throughout.
Append-only audit log of every view, edit, signature, archival and disposal.