Security & trust

The rules the pipeline enforces

1. Pixels come from deterministic code. Rendering is tested code applying your committed brand specification. AI may author content where you allow it; with every engine except the optional agentic one, it never draws your deliverable. The agentic engine (self-managed deployments only, off unless an operator turns it on) sends deck content to your model provider and has an AI agent write and run the build script for each deck, with shell access on the machine it runs on.

2. Decks sent in through the watched folder carry their egress class. zero-egress or contract-protected-api — written by the pipeline based on the engine that ran the job, never by hand. A job that touched an AI model cannot be labelled zero-egress. Web-app, /v1 API and MCP jobs are not labelled, in any mode.

3. On-prem mode runs no AI by default. The standard on-prem engines use no model, no cloud and no internet — checked at handover, on your hardware. Here zero-egress means DocMark sends nothing off the box. An operator can enable AI engines on an on-prem box. The watched-folder intake starts one only after the operator attests that a signed data-processing agreement is in place (DocMark cannot check the agreement itself). A job that uses an AI engine sends content to the model provider and is never zero-egress; watched-folder decks from it are labelled contract-protected-api.

4. AI engines on the watched folder need an attestation. The watched-folder intake will not start an AI engine unless the operator has attested that a data-processing agreement with your LLM provider is signed. On a client-cloud or self-managed deployment, web-app, /v1 and MCP jobs are not checked this way: they run on the deployment’s own provider key, under your contract with your provider (DocMark cloud jobs run on DocMark-managed AI). In API mode the other AI engines cap output tokens per call (the Claude-subscription max mode has no token cap); the agentic engine is bounded by a turn limit and a time limit but has no per-job spend cap, so set a spend limit with your provider.

5. Two meanings of zero-egress, never blurred. On-prem zero-egress means DocMark sends nothing off the box (keeping the box off the internet is your network’s control). In DocMark cloud, zero-egress means no PII reaches the execution plane — identity stays in the control plane, the render worker never sees it. The DocMark-cloud meaning describes the mode and is never written as a label; labels exist only on watched-folder decks (item 2).

6. Synthetic media is consent-gated and disclosed — always. When video featuring a presenter likeness or a cloned voice ships (it is on the roadmap, not yet in any mode), it will require recorded consent before the pipeline will produce it, and the deliverable will disclose that it is synthetic. No product flag, mode, or entitlement can bypass this.

7. A deliverable that fails the verification gate is withheld, with findings. What the gate checks:

   • Decks: the deck is read before it is rendered, and a slide carrying nothing a reader could see — no text, picture, chart, table or media, only decoration such as a background panel or an accent bar — withholds it. Every slide is then rendered, and a blank (single-colour) slide withholds it too. On-prem decks from the standard engines are also checked for text contrast; DocMark cloud decks are not.
   • Documents and spreadsheets: structural and integrity checks — the file must reopen and must not be blank or torn; workbooks must carry no live formulas, macros or external links.
   • Newsletters: image size, dimensions, and a blank-image check.
   • Brochures: PDF, page-count and portrait checks; no blank-page check.
   • Video: size and duration checks withhold a broken file. Blank frames withhold a video only when every frame of a video of two or more slides is blank; a partly blank video ships, and a frame that cannot be checked is skipped.

   Where it depends on setup:

   • Self-managed installs: the deck gate is on by default. It runs unless an operator explicitly turns it off, and anything other than an explicit off value — including no setting at all — leaves it on. Turning it off on a self-managed install takes a second, deliberate override as well — named in your handover documentation, so ask for it to be confirmed at handover. Without that override the opt-out is refused and the gate stays on. The one-off command-line render is gated too. If the check itself cannot run, the deck is withheld and removed rather than delivered unchecked — if the file is locked, the service says so in its log and the deck can remain in the results folder until an operator removes it.
   • The optional agentic engine (self-managed only): it is instructed to run its own visual review and DocMark does not verify that it ran — so the deck gate is applied to its output as well, exactly as to every other engine. It skips only the text-contrast check, which mis-fires on photographic covers.

   Not checked in any mode yet: logo placement, colour compliance, text overflow and AI-vision review (on the roadmap).

Provenance you can audit

Every deliverable records exactly which version of your brand specification produced it. When your brand changes — new logo, new palette, new template — you can prove which documents were produced under which rules, months later.

What “verified” means (and doesn’t)

Verified means the deliverable passed the verification gate described in point 7 above. It does not mean DocMark fact-checked the content — your authors (human or AI) own the substance, and web-research outputs ship with cited sources so your reviewers can check them. This holds in every mode.

Want the detail? The security one-pager covers the trust boundaries, the egress classes, and the consent gates in a form your security team can file.