Encryption
AES-256-GCM encryption for documents at rest. TLS 1.3 in transit. Every upload is verified against a SHA-256 hash before it counts as accepted.
Security and trust
Serious security for your data.
Business and financial records are sensitive. We treat them that way.
Compliant with the Zakon o arhivskoj građiAES-256Data stays in the EUGDPR/ZZPL
Access and control
Granular permissions per document, folder and workspace. Anonymous share links with an expiry date. A permanent append-only audit log that cannot be altered.
Infrastructure
Data does not leave the European Union.
Compliance
A retention guard blocks deletion of documents before the statutory period ends. Documented izlučivanje under Pravilnik 34/2022, with a written Zapisnik o izlučivanju. Weekly integrity verification of every document.
The controls in detail
Compliance
- Zakon o arhivskoj građi i arhivskoj delatnosti, the Serbian archives act (Sl. glasnik RS 6/2020)
- Zakon o računovodstvu, the accounting act - retention periods for financial records
- Zakon o zaštiti podataka o ličnosti, the personal data protection act (ZZPL/GDPR)
- Pravilnik o obrascu arhivske knjige 34/2022 - the official form, in Cyrillic script
Encryption and transport
- AES-256-GCM for every document at rest
- TLS 1.3 for every connection in transit
- SHA-256 verification of every document at import and at the weekly check
Integrity and audit
- A SHA-256 checksum is mandatory on every entry
- Append-only audit log - no entry can be altered or deleted before its period expires
- Weekly integrity verification: a priority pass over documents whose period is about to expire, plus a random sample of the rest
- The owner is alerted on the first checksum mismatch
Documented izlučivanje
- Deleting documents whose period has expired goes through the official workflow
- The owner approves the izlučivanje proposal before anything is deleted
- The system generates a Zapisnik o izlučivanju (DOCX/PDF), and only then deletes
Data location
- Data does not leave the European Union
Dokumentar.rs encrypts data with AES-256-GCM and keeps every file on servers in the European Union. Each document gets a SHA-256 checksum on import. Once a week the system re-checks those checksums and warns you if anything does not match.
The audit log is append-only at database level: no entry can be altered or deleted before the prescribed period expires. Documented izlučivanje follows the official workflow with a Zapisnik o izlučivanju, under Pravilnik 34/2022.
We meet the requirements of Zakon o arhivskoj građi (6/2020), Zakon o računovodstvu, Zakon o zaštiti podataka o ličnosti (ZZPL/GDPR) and Pravilnik o obrascu arhivske knjige 34/2022. For B2B clients we offer a data processing agreement (DPA) on request.
Get the DPA
For B2B clients who need a formal personal data processing agreement (DPA) under ZZPL/GDPR - send us a request through the contact form and we will supply the completed document for signature.
Request the DPASecurity questions we get asked
Where are my documents stored?
Every file is stored on servers in the EU region, encrypted with AES-256. Data does not leave the European Union.
Who can see my documents?
Only the users you invite, with the permissions you set. Every access is written to the append-only audit log. Dokumentar staff have no access to your files without your explicit permission.
What happens to documents whose statutory retention period expires?
The system notifies you of an izlučivanje proposal. You, as the owner, approve the list. The system then generates the Zapisnik o izlučivanju, and only then deletes the documents. No document is deleted automatically without your approval.
How do you check that documents have not been altered?
Every document gets a SHA-256 checksum on import. Once a week the system re-checks the checksum and warns you if anything does not match.
Can I sign a data processing agreement (DPA)?
Yes. The DPA is available to download and we send it for signature on request. Write to us on the contact page.
More questions about security?
We are glad to walk through the specific controls and to sign a DPA.