Security & trust

The rules the pipeline enforces

1. Pixels come from deterministic code. Rendering is tested code applying your committed brand specification. AI may author content where you allow it; with every engine except the optional agentic one, it never draws your deliverable. The agentic engine (self-managed deployments only, off unless an operator turns it on) sends deck content to your model provider and has an AI agent write and run the build script for each deck, with shell access on the machine it runs on.

2. Decks sent in through the watched folder carry their egress class. zero-egress or contract-protected-api — written by the pipeline based on the engine that ran the job, never by hand. A job that touched an AI model cannot be labelled zero-egress. Web-app, /v1 API and MCP jobs are not labelled, in any mode.

3. On-prem mode runs no AI by default. The standard on-prem engines use no model, no cloud and no internet — checked at handover, on your hardware. Here zero-egress means DocMark sends nothing off the box. An operator can enable AI engines on an on-prem box. The watched-folder intake starts one only after the operator attests that a signed data-processing agreement is in place (DocMark cannot check the agreement itself). A job that uses an AI engine sends content to the model provider and is never zero-egress; watched-folder decks from it are labelled contract-protected-api.

4. AI engines on the watched folder need an attestation. The watched-folder intake will not start an AI engine unless the operator has attested that a data-processing agreement with your LLM provider is signed. On a client-cloud or self-managed deployment, web-app, /v1 and MCP jobs are not checked this way: they run on the deployment’s own provider key, under your contract with your provider (DocMark cloud jobs run on DocMark-managed AI). In API mode the other AI engines cap output tokens per call (the Claude-subscription max mode has no token cap); the agentic engine is bounded by a turn limit and a time limit but has no per-job spend cap, so set a spend limit with your provider.

5. Two meanings of zero-egress, never blurred. On-prem zero-egress means DocMark sends nothing off the box (keeping the box off the internet is your network’s control). In DocMark cloud, zero-egress means no PII reaches the execution plane — identity stays in the control plane, the render worker never sees it. The DocMark-cloud meaning describes the mode and is never written as a label; labels exist only on watched-folder decks (item 2).

6. Synthetic media: a generic voice today, and conditions on any presenter. A synthetic presenter (a likeness or a cloned voice) is not offered in any deployment mode today. If it is offered, it will run only with a consent record on file for the person depicted (DocMark checks that the record exists; it cannot verify the consent itself), and every such video will carry a visible disclosure that it is synthetic. No plan or entitlement removes these conditions. The narration in DocMark videos offered today uses a generic synthetic voice, with no human likeness and no voice cloning.

7. A deliverable that fails the verification gate is withheld, with findings. In short: each kind of deliverable has its own checks, and decks have the most. Logo placement, colour, text overflow and AI-vision review are not checked yet.

   What the gate checks:

   • Decks: the deck is read before it is rendered, and a slide carrying nothing a reader could see — no text, picture, chart, table or media, only decoration such as a background panel or an accent bar — withholds it. Every slide is then rendered, and a blank (single-colour) slide withholds it too. On-prem decks from the standard engines are also checked for text contrast; DocMark cloud decks are not.
   • Documents and spreadsheets: structural and integrity checks — the file must reopen and must not be blank or torn; workbooks must carry no live formulas, macros or external links.
   • Newsletters: image size, dimensions, and a blank-image check.
   • Brochures: PDF, page-count and portrait checks; no blank-page check.
   • Video: size and duration checks withhold a broken file. Blank frames withhold a video only when every frame of a video of two or more slides is blank; a partly blank video ships, and a frame that cannot be checked is skipped.

   Where it depends on setup:

   • Self-managed installs:
     • The deck gate is on by default. It runs unless an operator explicitly turns it off; any other value, including no setting at all, leaves it on.
     • Turning it off takes two steps. The off setting needs a second, deliberate override as well, named in your handover documentation (ask for it to be confirmed at handover). Without that override the opt-out is refused and the gate stays on.
     • The one-off command-line render is gated too.
     • If the check itself cannot run, the deck is withheld and removed, not delivered unchecked. If the file is locked, the service says so in its log, and the deck can remain in the results folder until an operator removes it.
   • The optional agentic engine (self-managed only): it is instructed to run its own visual review and DocMark does not verify that it ran — so the deck gate is applied to its output as well, exactly as to every other engine. It skips only the text-contrast check, which mis-fires on photographic covers.

   Not checked in any mode yet: logo placement, colour compliance, text overflow and AI-vision review (on the roadmap).

Provenance records

Each job gets a provenance record, kept alongside the result rather than inside the file. You read it through the /v1 API and MCP, or beside the result on-prem.

• DocMark cloud: the record names the brand and where it came from, plus the design profile (if one was selected) and the engine. When your brand is served from DocMark’s versioned brand store, it also names the brand version, so when your brand changes — new logo, new palette, new template — you can show which documents came from which version. Otherwise it names where the brand came from, not a version.
• Client cloud: the record names the engine. It names no brand version, because client cloud has no versioned brand store.
• On-prem: the record names the engine and the network isolation, not the brand.

The record is best-effort: it is written after the render, and a job still completes without it, so check for it rather than assume it is there.

What “verified” means (and doesn’t)

Verified means the deliverable passed the verification gate described in point 7 above. It does not mean DocMark fact-checked the content — your authors (human or AI) own the substance. This holds in every mode.

Want the detail? The security one-pager covers the trust boundaries, the egress classes, and the consent gates in a form your security team can file.