NexDok provides four workspace-level roles in a strict hierarchy: Viewer (read-only access to documents and collections), Editor (can create and edit documents, upload versions, and request approvals), Admin (full document management, member management, publish/archive, security configuration), and Owner (same as Admin, with the added protection that the last owner cannot be removed or demoted).

Data isolation is enforced at every level. Every database table includes a tenant_id column, and all queries filter by tenant. Row-Level Security (RLS) policies are active on all tables to prevent cross-tenant access even at the database level. File storage uses tenant-scoped paths. The API validates workspace membership on every request before returning any data.

Security Zones are permission boundaries within a workspace. They allow you to create logical areas (e.g., Legal Department, Executive, Public) and control which users or groups can access documents and collections within each zone. Zones support user-level and group-level permission grants with viewer, editor, and manager levels.

Access Groups are named sets of users within a workspace. Instead of granting permissions to individual users one by one, you can create a group (e.g., Finance Team, External Auditors), add members to it, and then grant the group access to collections or security zones. When a user is added to or removed from the group, their access updates automatically.

NexDok supports an optional document approval workflow. An editor can submit a specific document version for approval, selecting one or more approvers from the workspace members. Each approver independently reviews and approves or rejects. A single rejection closes the request immediately. When all approvers approve, the document becomes eligible for publication. Approval is version-specific — uploading a new version does not affect a pending approval on an older version.

Yes. Only users with Admin or Owner role can publish documents. Additionally, when an approval workflow is active for a document version, publication is blocked until all designated approvers have approved. This dual gate (role + approval) ensures that documents go through proper review before becoming official.

API Keys enable server-to-server integration without requiring user JWT tokens. Each key is scoped to a specific workspace and has configurable permissions (upload, query, ask). Keys are stored as SHA-256 hashes — the raw key is shown once at creation and never stored. Keys can have expiration dates and can be revoked at any time. The number of API keys allowed depends on your plan.

Yes. NexDok maintains multiple layers of audit information: an events table that records all document lifecycle events (created, published, archived, deleted) with actor, timestamp, and payload; a workflow history table that tracks all state transitions with before/after snapshots; and a governance audit log for account-level operations (member changes, tenant management). All audit writes are transactional — they occur atomically with the operations they record.

When an admin disables a workspace member, that user immediately receives a 403 error on all API calls to that workspace. Their data is preserved, and they can be re-enabled at any time without losing their role or history. The last active owner of a workspace cannot be disabled, preventing accidental lockout.

When a new member is invited to a workspace, they receive a pending status. On their first authenticated API call (typically when they log in and the app loads), their status is automatically activated. This lazy-activation approach means no separate accept invitation step is required — the member simply logs in and starts working.

No. Account-level roles (Billing Owner, Billing Admin, Account Admin) are strictly separated from workspace-level roles. A Billing Owner can manage subscriptions, create workspaces, and suspend tenants, but they cannot access any documents unless they are also explicitly added as a member of that workspace. This separation ensures billing administrators do not automatically gain access to sensitive document content.

Yes. Beyond workspace roles and collection visibility, NexDok supports document-level Access Control Lists (ACLs). Permissions can be granted to specific users, roles, or publicly within a workspace. Available permission types include read, write, manage, and publish. When ACL entries exist on a document, only grantees (and workspace admins) can access it.

All document files are stored in cloud object storage using tenant-scoped paths that prevent cross-tenant access. Files are never served directly — the backend generates time-limited signed URLs (10-minute expiry) for downloads. The service credentials that access storage are never exposed to the frontend or API consumers.