The Vukorix production application, its database, and every uploaded file run in the DigitalOcean Sydney (SYD1) region. Vukorix is operated by Osmicro Networks Pty Ltd, an Australian company registered in New South Wales, and personal information is handled under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Some sub-processors do work offshore, including Google Analytics for aggregated website analytics and the transactional email provider that sends operational email. Those are cross-border disclosures under Australian Privacy Principle 8, and every sub-processor is listed with its purpose and location in the Privacy Policy. Vukorix does not claim that no data ever leaves Australia.
The rest of this page is a technical overview for security, risk, and procurement teams: trust boundaries, encryption, access control, product processing, monitoring, and recovery, along with the controls Vukorix does not claim to have.
Last reviewed: 24 June 2026
Vukorix separates the client and recipient experience, product processing, stored data, and service operations into distinct security responsibilities. The application, database, and uploaded files all sit in Sydney (SYD1), and requests reach that region through the Cloudflare edge described below.
Users authenticate to their organisation account. Recipients use controlled links and any required PIN, password, SMS code, expiry, or view limit. Private mode encryption begins in the sender's browser for supported file transfers. Cloudflare fronts the Vukorix domains for DNS and edge protection; it is not where your documents are stored.
Vukorix applies account access rules, recipient controls, product processing, status updates, and relevant event recording. Standard-processing features can access file contents only where the selected product requires it.
Stored content is encrypted and held in the Sydney (SYD1) region, alongside the production application and database. Operational access is restricted, monitoring and alerts run continuously, and backups and recovery procedures are maintained.
The security model differs according to the product feature being used. Features that need document preparation, previews, signing, forms, or messaging require secure server processing. Supported Private mode transfers keep file contents outside the Vukorix processing boundary.
Standard secure processing supports product features that need access to document contents. Private mode moves supported file encryption into the sender's browser.
| Area | Standard secure processing | Private mode |
|---|---|---|
| Where content is stored | Sydney (SYD1), in the same region as the application and database. | Sydney (SYD1), stored as ciphertext. |
| Where encryption begins | The connection between the browser and Vukorix is encrypted. | The file is encrypted in the sender's browser before upload. |
| Stored content | Stored file content is protected using AES-256-GCM with a Vukorix-managed key. | Vukorix stores encrypted file data and does not have access to the file contents. |
| Content processing | Authorised Vukorix systems can process document contents where required by the selected product feature. | Vukorix systems do not decrypt the supported file contents. |
| Feature support | E-Sign, Smart Forms, Document Library, previews, redaction, and Secure Exchange messaging. | Secure Share, Secure Receive, and supported Secure Exchange file transfers. |
| Recovery | Content remains available through the organisation's authenticated account while retained by the service. | Vukorix cannot recover file contents if the required link information or passphrase is lost. |
| Metadata | Account, recipient, product, and event information may be recorded according to the selected feature. | File contents are protected, but operational metadata may still be retained. |
Private mode protects supported file contents but does not remove all service metadata. Vukorix may retain sender identity, timestamps, file size, and ciphertext integrity information needed to operate and secure the service.
Recipient IP address and user-agent information are not retained on Private mode events.
Filenames can be hidden where the selected product supports that option.
The required decryption information may depend on the share link or passphrase. If it is lost, Vukorix cannot recover the file contents.
| Product | Processing path | Why content processing is needed | Security result |
|---|---|---|---|
| E-Sign | Standard secure processing | Prepare the PDF, place fields, complete signing, and produce the signed document and records. | Encrypted transfer and storage, optional recipient access checks, signed PDF, certificate page, and separate audit-pack PDF. |
| Document Library | Standard secure processing | Store approved PDF templates and create fresh E-Sign drafts. | Encrypted transfer and storage with authenticated organisation access. |
| Smart Forms | Standard secure processing | Prepare the PDF, suggest and place fields, and produce the completed PDF. | Encrypted transfer and storage, with the completed PDF kept with the related request or exchange. |
| Secure Share | Standard secure processing or Private mode | Create controlled links with expiry, view limits, and optional access checks. | Private mode adds browser-side encryption and prevents Vukorix from accessing supported file contents. |
| Secure Receive | Standard secure processing or Private mode | Collect requested client documents and show request status. | Private mode adds browser-side encryption for supported client uploads. |
| Secure Exchange | Standard secure processing and Private mode for supported file transfers | Connect incoming files, outgoing documents, messages, Smart Forms, and E-Sign items. | Messages, Smart Forms, and E-Sign items use Standard processing. Private mode applies only to supported file transfers. |
Vukorix records relevant account and product events and provides product-specific completion records.
Completed E-Sign documents include the signed PDF, a certificate page, and a separate audit-pack PDF.
Completed Secure Exchange items can include a completion certificate and audit pack.
Vukorix does not publicly claim that event records are append-only, HMAC-chained, or independently tamper-proof unless those controls are separately verified.
Manual PDF Redaction is available inside the E-Sign and Smart Forms editors. The selected page is rasterised, opaque areas are applied, and the exported page is produced as an image-based copy.
The underlying PDF text is removed from the selected area in the exported copy. The document owner retains the original source document.
The production application, its database, and uploaded files all run in the DigitalOcean Sydney (SYD1) region. Cloudflare fronts the Vukorix domains for DNS and edge protection. The providers that host the service maintain recognised information-security certifications, such as ISO 27001; those certifications belong to the providers, not to Vukorix. Account identifiers, credentials, and internal network topology are not published on this page.
Automated monitoring and alerts run around the clock to help identify and investigate operational issues.
Backups and recovery procedures are maintained as part of normal service operations.
Changes are tested before release, with security and reliability reviewed as the service evolves.
When monitoring identifies an issue, Vukorix investigates it, uses available recovery procedures where needed, and applies what is learned to improve the service.
Administrative access is limited to authorised purposes and is not exposed through the public customer experience.
Customer Content is stored in the Sydney (SYD1) region and handled according to the selected product and encryption path. Standard-processing features can access file contents where required. Private mode protects supported file contents from Vukorix access.
Vukorix retains the account, product, event, and technical information required to operate, secure, and support the service. That account, product, and event metadata is held in the same Sydney region as the documents it relates to. Aggregated website analytics data and operational email delivery records sit with the overseas sub-processors described below.
Retention and deletion are governed by the published Privacy Policy and the controls available in the selected product. The Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) applies to eligible data breaches. This page does not publish unverified per-product or backup-deletion timelines.
Your documents and account data are stored in Sydney. Some sub-processors work offshore, including Google Analytics for aggregated website analytics and the transactional email provider that delivers operational email. Those are disclosures to overseas recipients under Australian Privacy Principle 8, and every sub-processor is listed with its purpose and location in the Privacy Policy. Vukorix does not claim that no data ever leaves Australia.
Security and privacy are considered when product behaviour and data handling are designed.
Changes are tested before release, with security and reliability included in the review.
Vukorix reviews technical changes, customer feedback, operational events, and recognised security practices to improve the service.
Vukorix reviews its security design and operations against recognised security and privacy guidance, including the Australian Privacy Principles. This is not a claim of certification, formal conformance, or independent assurance.
Vukorix is not currently SOC 2 certified and has not completed an independent external cryptographic audit.
Vukorix is not ISO 27001 certified. Recognised information-security certifications, such as ISO 27001, are maintained by the providers that host the service, and those certifications belong to the providers rather than to Vukorix.
Vukorix has not been assessed under the Information Security Registered Assessors Program (IRAP), holds no Australian Government security accreditation, and makes no claim of alignment with the ACSC Essential Eight.
Vukorix does not claim that every product uses browser-side encryption, that every event record is independently tamper-proof, or that any online service can guarantee complete security.
This page will be updated as controls are independently reviewed and additional assurance becomes available.
The Vukorix production application, its database, and uploaded files all run in the DigitalOcean Sydney (SYD1) region. Cloudflare fronts the Vukorix domains for DNS and edge protection. Account identifiers, credentials, and internal network configuration are not published on this page.
Your documents and account data are stored in Sydney. Some sub-processors do process data overseas, including Google Analytics for aggregated website analytics and the transactional email provider that delivers operational email. Those are cross-border disclosures under Australian Privacy Principle 8, and every sub-processor is listed with its purpose and location in the Privacy Policy. Vukorix does not claim that no data ever leaves Australia.
Vukorix is operated by Osmicro Networks Pty Ltd, an Australian company registered in New South Wales. Personal information is handled under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Notifiable Data Breaches scheme applies, and complaints can be taken to the Office of the Australian Information Commissioner.
Files are encrypted during transfer and while stored. Standard secure processing uses AES-256-GCM for stored file content, with a Vukorix-managed key. Private mode adds browser-side encryption for supported file transfers.
E-Sign, Smart Forms, Document Library, previews, blackout and redaction, and Secure Exchange messaging require secure server processing. Private mode prevents Vukorix from accessing supported file contents.
Vukorix cannot recover the file contents if the required link information or passphrase is lost.
Private mode protects file contents but does not remove all operational metadata. Sender identity, timestamps, file size, and ciphertext integrity information may be retained to operate and secure the service.
Vukorix accounts use two-factor authentication, including WebAuthn passkeys and authenticator apps.
Automated monitoring and alerts run around the clock. Backups and recovery procedures are maintained, and changes are tested before release.
Vukorix is not currently SOC 2 certified, is not ISO 27001 certified, and has not completed an independent external cryptographic audit. It has not been assessed under the Information Security Registered Assessors Program (IRAP) and holds no Australian Government security accreditation. Recognised information-security certifications, such as ISO 27001, are maintained by the providers that host the service, not by Vukorix.
Review the published policies, or put your questions to the Australian team that operates Vukorix.