Doppelgone
Start the free audit

Security sheet

Version 1.1, in force from 29 October 2026 for pilot customers (version 1: 26 October 2026). Not yet reviewed by a lawyer; wording may change before general release.

One page on how Doppelgone for Work protects your company's data. It describes what we do today. It is not a certification. Questions: work@doppelgone.app.

The short version

We read metadata and hashes, not your files. We never store file contents. Removed files go to your own Microsoft 365 recycle bin, restorable for up to 93 days. We never delete permanently and never empty the bin; after the 93 days Microsoft, not Doppelgone, deletes them.

What we hold, and what we don't

We hold We don't hold
File names, paths, sizes, dates, hashes, owners, sharing settings File contents
A text fingerprint (MinHash) of each document, built so the text cannot be rebuilt from it The text itself
Duplicate groups and the actions you approved Previews or thumbnails
An audit log of every action Excerpts (read in memory during comparison, then discarded)
Tenant id, admin and reviewer names and emails Your users' passwords (sign-in is Microsoft's; we never see them)
Purchase records (through Polar) A stored secret that can read every customer's tenant (see "Keyless credentials")

Access to your tenant

  • Your Microsoft 365 admin consents to our Entra application. You can see and revoke that consent in your Entra admin centre at any time.
  • The free audit asks for read-only Microsoft Graph permissions. It cannot change or move anything.
  • Write permissions belong to a second, separate application. Your admin consents to it only when you start a clean-up, and it is used only to move files you approved to the recycle bin and to restore them. You can revoke it on its own.
  • Inside Doppelgone, roles limit who can do what: owner, admin, reviewer, viewer.

Keyless credentials

Our application authenticates to Microsoft with federated credentials (Vercel OIDC to Entra workload identity federation). There is no client secret stored anywhere: not in our hosting provider, not in our code, not on a laptop. A leaked secret that could read many customers' tenants is the single worst thing that could happen to a product like this, so we built it out.

Tenant isolation

  • Every row in our database carries your organisation id, and every query is scoped by it.
  • An automated test suite proves that organisation A can never read organisation B's data. It runs on every change before it ships.
  • Caches (for example AI judgments) are keyed per organisation and never shared across customers.

Encryption

  • In transit: TLS everywhere, between your browser and us, between us and Microsoft, and between us and every provider.
  • At rest: encrypted by our database and hosting providers (Supabase on AWS, EU Ireland region; Vercel, EU Dublin region).

The AI provider

For near-duplicate documents, short text passages and coarse facts ("two proposals, same client, prices differ") are sent to TypeSafe for a judgment. No file names, no paths, no owner names, no tenant identifiers go with the request, though a passage can itself contain a name. TypeSafe is a listed subprocessor; see the Subprocessor list for the status of its data processing agreement and what it keeps.

Logging

  • We log actions, not content. File names never appear in our logs.
  • Every move and restore is in your audit log, exportable at any time.
  • Support access through our admin tool is written into the customer's own audit log with the reason. Direct database access, kept for incidents, is recorded by hand with who, when and why.

People

  • At launch, Doppelgone for Work is operated by one person, the founder, who is the only person with production access.
  • MFA is required on every operator account (hosting, database, cloud, email, payments).
  • Production access is used only to resolve support requests and incidents.

Where your data is

Database: EU (Ireland). Application functions: Vercel, EU (Dublin). Vercel, Resend and Polar are US companies, and we operate from South Africa. Your data leaves South Africa. The Data processing agreement carries the POPIA section 72 and GDPR transfer clauses that make this lawful. South African hosting is available as an Enterprise option by quote.

Incidents

  • If there are reasonable grounds to believe your data is involved in a security compromise, we tell your account owner immediately, and at the latest within 48 hours, with what happened, what is affected and what to do. That leaves you time for your own duties (POPIA sections 21 and 22; GDPR Article 33).
  • Report a vulnerability to the address in our security.txt at work.doppelgone.app/.well-known/security.txt. We reply within one business day.

Testing and certifications

  • An independent penetration test will be carried out before the first paid clean-up runs, and its summary is then available to customers on request. Until then there is none; free pilots run before it.
  • The tenancy test suite and the engine's safety tests run on every change.
  • We do not hold SOC 2, ISO 27001 or similar certifications. We are a small company and we say so. If your procurement requires one, tell us and we will tell you honestly whether and when we could get it.

Safety rules in the product

These are how the clean-up works, not guarantees:

  • Files move only to the recycle bin. Never permanent deletion, never emptying the bin.
  • We never remove the only copy of a file; every group keeps at least one.
  • Right before each move we check again that the copy has not changed and that the copy we keep can be opened by everyone who could open the one we move.
  • We skip files Microsoft reports as on legal or retention hold.
  • Every item, group or run can be undone from inside Doppelgone while it is in the bin.
  • Microsoft keeps binned files for up to 93 days (Google Drive, when supported: 30 days). After that the platform deletes them, not Doppelgone. Anyone in your organisation who empties the bin ends the window sooner.
  • Binned files still count towards your Microsoft storage until they leave the bin.

Retention

Inventory deleted 90 days after your last scan. Audit log and clean-up records kept while your account is open. Everything deleted 30 days after you leave (on request sooner), except what tax law requires us to keep. Details: Data processing agreement, section 10.

Computron Tech (Pty) Ltd, trading as Doppelgone. Last reviewed: 29 Oct 2026.