An honest account of where we are
Not a marketing page dressed up as one. What is available now, what is in progress, and what is on the roadmap.
Do you train on our data?
No. DevDocs does not train, fine-tune, or otherwise improve any machine learning model on your documentation content or your visitors' questions, and we do not permit our subprocessors to do so. This is stated plainly in our Terms of Service and Privacy Policy, without qualifiers.
SOC 2
We are currently pursuing SOC 2 Type II, with completion targeted for late 2026. This work is in progress: we are not yet certified or audited.
The design partner program has no service level agreement
We work to keep the service reliable, but during the design partner period there is no SLA. We say this plainly rather than let it surface as a surprise during a review.
Status
| Item | Status | Detail |
|---|---|---|
| Tenant isolation | Available now | Every workspace is resolved only from the hostname a request actually arrives on, never a client-supplied header. Storage paths are re-derived server side from validated identifiers on every access, never taken from a request payload. |
| No training on customer content | Available now | We do not train, fine-tune, or otherwise improve any model on your documentation or your visitors' questions, and our model provider's terms do not permit them to either. |
| Encryption in transit | Available now | All traffic to hosted.devdocs.ai and every workspace subdomain is served over TLS. |
| Encryption at rest | Available now | Stored documentation content, search indexes, databases, and the audit store are encrypted at rest by our platform. |
| Role-based access control | Available now | Owner, admin, editor, and viewer roles, enforced at a single authorization point in our codebase. |
| Grounded, citation-verified AI answers | Available now | The assistant answers only from a workspace's own published documentation, every citation is checked against the source text before display, and an answer with no verified citation is not shown. |
| Permission-aware retrieval for private sources | Available now | Public chat only retrieves public content. Signed-in members can use private docs chat that filters restricted ACL keys from connected sources. Marketing-site FAQ chat answers from a FAQ database only and does not call a model for unauthenticated visitors. |
| Append-only audit trail | Available now | A tamper-evident, hash-chained log of administrative and security-relevant actions, including invitations, membership changes, member sign-ins, and failed sign-in attempts when recorded. Workspace owners and admins can view their trail in the dashboard and export CSV or JSON. |
| Usage metering and credit ledger | Available now | AI and related work are metered per workspace on D1. Operators see balance, ledger, manual top-off, and auto top-off under AI usage. Measurement stays on our control plane. |
| Stripe self-serve checkout | Available now | Plan upgrades and credit packs use Stripe Checkout and webhooks. Card details stay on Stripe-hosted pages. Metering and the credit ledger remain on D1. Design partner access may still be free at our discretion during early access. |
| Operational logs (Better Stack) | Available now | Cloudflare Workers Trace Events and operational logs are drained via Logpush to Better Stack for reliability and incident response. Not used as a marketing tracker on workspace documentation hosts. Named on the public subprocessor list. |
| Application error monitoring (Sentry) | Available now | The Worker and apex app report errors and sampled performance traces to Sentry so we can detect and fix failures. Configured to avoid request bodies and default PII. Not a marketing tracker on workspace hosts. Named on the public subprocessor list. |
| Knowledge index vs package go-live | Available now | Source sync indexes knowledge for chat and MCP without flipping the live docs package. Explicit Sites promote or CI package push is what goes live. |
| Multi-site primary and promote | Available now | Workspaces can create additional host labels (up to plan max), set primary, promote a package version from Sites, point a *-preview host at a package without cutover, and run sticky A/B against a partner site package. Custom domains are not live yet. |
| SAML SSO | Roadmap | Not available today. On the roadmap; we are not committing to a date until we are confident we will hit it. |
| SOC 2 Type II | In progress | See the SOC 2 statement above. |
For your review
The documents a security or procurement reviewer usually asks for are public and linked below. Our data processing agreement sets out the controller and processor split and the EU Standard Contractual Clauses, the subprocessor list names every vendor in the path, and the Privacy Policy states the no-training commitment in the same words.
Reporting a vulnerability
Email security@devdocs.work, or see /.well-known/security.txt (RFC 9116) for the machine-readable version.