Trust Center
Enterprise security, compliance, and data-handling reference for REFRACT PDF. Share this section with your security team, procurement department, or any customer requesting a security review.
Last updated: 2026-05-31 · Version: 1.0
For the most recent SOC 2 status, pen-test summary, or DPA, contact sales@refractlogic.com.
REFRACT PDF uses a customer-owned infrastructure model. Every component that processes or stores your documents deploys into your own Azure subscription via the supplied Bicep templates. REFRACT PDF does not operate a shared multi-tenant processing environment.
Share This Section
This section is designed to be shared with your security team, procurement department, Microsoft AppSource reviewers, or any customer requesting a security review.
Documents in This Section
Architecture & Data Flow
Full data-flow diagrams, trust boundaries, and key management overview for security architects, procurement teams, and auditors.
Security Controls
Authentication, encryption, network isolation, key management, and audit controls for CISO and security teams.
Data Processing Guide
What data REFRACT PDF processes, where it flows, retention periods, and GDPR posture for DPO and legal teams.
Sub-Processor List
Lists third parties used by Refract Logic, for enterprise procurement requirements.
Incident Response
Incident response procedures and customer notification timelines for CISO and operations teams.
Consent Policies
The published registry of the REFRACT system consent policies, with every version's full text and SHA-256, and how to publish your own. For legal and compliance teams.
Security & Verification
Authentication layers, access control enforcement, document integrity verification, and deep-link safety. For security architects and implementation teams.
Key Security Properties
| Property | Detail |
|---|---|
| Customer-owned infrastructure | All processing components deploy into your Azure subscription. Refract Logic staff have no standing access. |
| Document data stays in your subscription | Rendering, storage, and audit run in your Azure subscription. REFRACT hosts the signer/recipient portal, licensing, and notifications - see Security & Verification for exactly what each product sends there. |
| Zero standing vendor access | Refract Logic staff have no access to your Azure Key Vault, Azure Blob Storage, or Isolated Azure Functions. |
| Append-only, cryptographically chained audit trail | Each eSign/Workflow audit entry carries the hash of the one before it. Write-once (WORM) storage protection is deployed but ships unlocked by default. |
| Managed Identity authentication | Isolated Azure Functions use Managed Service Identity for all internal Azure service access. No stored secrets or passwords are used for internal service calls. |
What We Can Provide Now
- Architecture diagrams with trust boundaries
- Security controls overview
- Data processing guide and GDPR posture
- Sub-processor list
- Incident response procedure
Certifications
Refract Logic holds no independent certifications today: no SOC 2 report, no ISO 27001 certificate, and no third-party penetration test summary. These require independent auditors and cannot be self-attested. A Data Processing Agreement (DPA) is available on request - contact sales for the current status of that and any other compliance artifact.
Enterprise Procurement and Security Inquiries
Contact us for DPA requests, security questionnaires, and enterprise procurement support.
Security & Verification
How REFRACT Platform enforces security at every layer - from Entra ID authentication and Managed Identity through item-level access control, document integrity verification, and deep-link safety in REFRACT Lifecycle.
Architecture & Data Flow
Full data-flow diagrams, trust boundaries, and key management overview for REFRACT PDF. The canonical architecture reference for security architects, procurement teams, and AppSource reviewers.