Security Policy
Meshed Up Pty Ltd (“Meshed Up”) and its docMesh Document Intelligence platform
(“docMesh”) are committed to the security and privacy of our customers’ data. Our handling
of customer documents, information, and data in the docMesh platform are conducted
under a robust and transparent security program. Key aspects of this security program are
set out in this document.
Purpose
This policy was written to describe a security framework for employees and customers of Meshed Up including, but not limited to, users of its docMesh Document Intelligence platform
Infrastructure
docMesh Data in the cloud
All docMesh servers and infrastructure are hosted on Microsoft’s Azure cloud platform.
Azure provides a scalable and robust infrastructure platform with class-leading security architecture. Except when specified in a customer agreement or otherwise agreed, all customer data is stored and processed in Australian data centres.
Connectivity
All connection to the docMesh web applications and services uses HTTPS and Transport Layer Security (TLS). This means that all traffic to and from our services is encrypted and has protection against interception or exposure.
Encryption of Data
All protected data is encrypted at rest, at both file system and database levels.
Backup of Data
All docMesh file systems and databases are regularly backed up and are configured for redundancy and high availability.
Malware Scanning
All files submitted to docMesh for processing are scanned for malware. Any files identified as containing malware will be automatically quarantined and excluded from processing.
Intrusion Detection
Microsoft Defender for Cloud is used to protect and proactively monitor the docMesh infrastructure. Regular review of security recommendations is undertaken.
Data Retention
By default, extracted document data is stored for a customer for 365 days from the date of extraction. After this time, the data is archived from docMesh and is no longer available. This retention period can be altered to any desired value, from immediate removal of customer data through to indefinite storage (subject to the terms of any applicable Meshed Up customer agreement)
Some document metadata such as filenames, time stamps and classification records will be retained for compliance purposes but no data from within processed documents is retained after the archive period.
Data Segregation
Customer data is stored in separate tenant databases with no cross-connectivity. This is designed to achieve robust segregation between our customers and mitigate data protection concerns.
Test and production database servers are isolated, with separate security access to the two environments.
Internal docMesh processing uses storage locations which are not customer accessible. File storage is separated by customer and one customer’s data is not accessible to any other customer.
Processing Control
docMesh extracts and correlates data from a customer’s business documents. Accordingly, by submitting a document to docMesh for ingestion and processing, a customer confirms that they have authorisation to do so, and the extracted data will be treated in line with respective data processing and privacy obligations as further described in the applicable Meshed Up customer agreement.
Personnel Responsibilities
Data Privacy
Privacy of our customers’ data is of paramount importance to Meshed Up. You may request a copy of our privacy policy by emailing privacy@docmesh.com
Password Security
docMesh does not store security login information of our customers. Instead, we use Microsoft Entra b2c security infrastructure to allow customers to associate their own account access with the docMesh system. This means that Meshed Up staff and associates do not have access to a customer’s account credentials and allows a customer’s specific data protection and password security rules to be applied. Where possible, Meshed Up recommends that a customer makes use of strong passwords and Multi-Factor Authentication (MFA) to increase account security.
Device Security
Meshed Up employees and affiliates make use of password management software and multi-factor authentication.
We use device-level encryption to maintain high levels of security on Meshed Up hardware and devices.
Incident Management
In the event of unauthorised disclosure of customer data, Meshed Up will notify impacted customers in accordance with the applicable Meshed Up customer agreement.
If a customer becomes aware of a potential compromise of their account or of docMesh data, they must notify Meshed Up by emailing security@docmesh.com
Review
This policy will be reviewed and updated from time to time as infrastructure and the nature of our security posture evolves. For the latest version of the policy, please contact security@docmesh.com