Trust
What Doppelgone for Work can see, what it keeps, where that lives, who else touches it, and what we do when something goes wrong. Plain statements of what is true today, not a certification. The security sheet, data processing agreement and subprocessor list are the formal versions. The security page has a questionnaire (CAIQ-lite) you can download and pass to your procurement team.
The short version
We read metadata and checksums, not your files. The audit is read-only. We never store file contents. Removed files go to your own recycle bin for 93 days, and Microsoft deletes them after that, not us. There is no stored secret that can read every customer’s tenant.
Permissions, and why each one
| Microsoft Graph permission | When | What it is for |
|---|---|---|
User.Read.All | Audit | Names and emails of the people in the tenant, and whether they are still active. |
Group.Read.All | Audit | Group memberships, to check who can open a file before its copy is suggested. |
Sites.Read.All | Audit | SharePoint sites and libraries: file names, paths, sizes, dates, checksums, sharing, versions. |
Files.Read.All | Audit | The same for OneDrives; a document’s text, read in memory, when two look alike. |
Sites.ReadWrite.All, Files.ReadWrite.All | Clean-up only | Move an approved file to the recycle bin; restore it. Requested when you buy a clean-up, never before. |
A Global Administrator grants them through Microsoft’s admin consent and can revoke them at any time in the Entra admin centre. Our application authenticates with federated credentials (Vercel OIDC to Entra workload identity federation): no client secret exists in our hosting, our code or on a laptop.
What we hold, and for how long
| We hold | Why, and until when |
|---|---|
| File names, paths, sizes, dates, checksums, owners, sharing, version counts | For the inventory and the groups. Deleted 90 days after your last scan. |
| A fingerprint (MinHash) of each document’s text | To find look-alikes without keeping the text. It holds no readable text. |
| Groups, the keeper, the reason, the action you approved | The report and the clean-up. |
| Your tenant id, and the names and emails of the people you invite | Sign-in and roles. |
| An audit log of every action | Kept for your subscription plus one year; exportable. |
| Purchase records | Held by Polar, the merchant of record. |
We never hold: file contents, previews or thumbnails, text excerpts beyond the moment of comparison, or your users’ passwords (sign-in is Microsoft’s). File names never appear in our logs. Every row in our database carries your organisation id; an automated suite proves on every change that one organisation can never read another’s data, and caches of AI judgments are keyed per organisation.
The AI judge
When two documents look alike, a small language model (TypeSafe’s Jev) answers one question: are these the same document, a later version, or different documents that share a template? It sees short text passages and coarse facts (“two proposals, same client, prices differ”), never file names, paths, owners or tenant identifiers. TypeSafe runs in the United States and does not train its models on what it is sent. Its answer can only ever send a pair to review or leave it alone; it never pre-selects a removal by itself.
Where your data is, and the law that covers it
Database in the EU (Ireland). Application functions in Vercel’s EU region (Dublin); some subprocessors are US companies. Your data leaves South Africa. The data processing agreement carries the clauses that make this lawful: POPIA section 72 (the recipient is bound to protection equivalent to POPIA’s) and the GDPR transfer terms. South African hosting is available as an Enterprise option by quote. We are Computron Tech (Pty) Ltd, registered in South Africa.
Subprocessors
| Who | What | Where |
|---|---|---|
| Microsoft (Graph API) | Your tenant, via the permissions above | Microsoft’s regions for your tenant |
| Vercel | Hosting, application functions | EU (Dublin); US company |
| Supabase (on AWS) | Database | EU (Ireland) |
| TypeSafe | AI judgment on look-alike pairs: short text passages and coarse facts, no names or paths | See their DPA |
| Resend | Transactional email (invitations, “your report is ready”) | USA |
| Polar | Checkout, invoices, VAT | EU/USA |
Safety rules in the product
- Files move only to the recycle bin. Never permanent deletion, never emptying the bin.
- Every group keeps at least one file, and the keeper must be openable by everyone who could open the copy.
- Files changed in the last 14 days, on legal hold, or owned outside the tenant are never suggested.
- Near-identical documents and versions the engine is not sure about go to a person; only identical files and clear older versions are pre-selected.
- Every item, group or run can be undone from inside Doppelgone while it is in the bin (93 days).
- The engine’s precision on pre-selected removals is measured on a labelled corpus before every release; the current figure and how it is measured are published in our evaluation notes on request.
People and access
Doppelgone for Work is operated by its founder, the only person with production access, with MFA on every operator account. Production access is used only to resolve support requests and incidents, and support access to a customer’s data is logged with who, when and why. Inside the product, roles limit what members can do: owner, admin, reviewer, viewer.
If something goes wrong
If your data is involved in a security compromise, we tell your account owner immediately, at the latest within 48 hours of learning of it, with what happened, what is affected and what to do, so you can meet your own duties (GDPR Article 33, POPIA section 22). A clean-up that moved something you did not approve is an urgent support case: write to work@doppelgone.app and we restore it the same business day.
Reporting a vulnerability
Email work@doppelgone.app (also in security.txt). We reply within one business day, keep you informed while we fix it, and credit you if you want. Please do not access other customers’ data or degrade the service while testing.
What we do not have
We do not hold SOC 2, ISO 27001 or similar certifications. An independent penetration test is carried out before the first paid clean-up runs; its summary is available to customers on request. If your procurement requires a certification, tell us and we will say honestly whether and when we could get it. The security questionnaire lists, question by question, what exists and what does not yet.
Last reviewed 27 October 2026.