# DocuSeal Security Review
# Classification: Confidential
# Date: 2026-06-09
# Reviewer: Claude Code (drafted); pending Founder approval
# Status: Draft

---

## 1. Vendor / Device Overview

| Field | Value |
|---|---|
| **Name** | DocuSeal (DocuSeal Inc. / `docusealco/docuseal`, open source, AGPL-3.0) |
| **Website** | docuseal.com · github.com/docusealco/docuseal |
| **Service / purpose** | Document e-signature platform — **self-hosted by CBB**, not the DocuSeal SaaS |
| **CBB use case** | Sign CBB legal agreements (NDAs, contracts). Signed PDFs → Azure Blob → auto-moved to OneDrive (`Legal_and_Trademarks/Signed_Agreements/`) via a Logic App + managed identity. |
| **Data tier(s) accessed** | Tier 3 (Confidential) — legal agreements, signer identity/contact data |
| **Access type** | Self-hosted container (`ca-docuseal-prod`) in CBB's VNet; no third-party SaaS account; CBB controls the platform and all document data |
| **Proposed onboarding date** | Already in production — retrospective review |

> **Key distinction:** This is **not a SaaS vendor relationship.** DocuSeal is open-source software CBB runs on its own Azure infrastructure. No document data leaves CBB's control to a DocuSeal-operated service. The review therefore assesses (a) the **OSS supply chain** and (b) **CBB's self-hosted deployment posture** — not a vendor's data handling.

---

## 2. Data Exposure Assessment

### 2.1 What CBB data will this vendor / device access?

The **software** processes:

- Legal agreement documents (templates + completed/signed PDFs)
- Signer identity and contact data (names, emails) entered into signing flows
- Audit-trail / signing-event metadata

Because it is self-hosted, **no DocuSeal-operated third party receives this data.** The data lives in CBB's Azure PostgreSQL (`psql-cbb-prod`), CBB's Azure Blob, and CBB's OneDrive.

### 2.2 Where will CBB data be stored by this vendor?

Entirely within CBB-controlled Azure + M365:
- **Database:** `psql-cbb-prod` (PostgreSQL Flexible Server, VNet-private)
- **Signed PDFs (staging):** Azure Blob (`stcbbprod`), private — no anonymous access; DocuSeal reads the account key from `kv-cbb-shared-prod/docuseal-storage-key`
- **Signed PDFs (system of record):** OneDrive `CBB_Corporate/03_-_Confidential/Legal_and_Trademarks/Signed_Agreements/`

### 2.3 Is any Highly Confidential data (Tier 4) involved?

- [ ] Yes
- [x] **No** — legal agreements are Tier 3 (Confidential), not Tier-4 SPEC/trade-secret material. (Some agreements *protect* the IP but are not themselves the engine/SPEC.)

---

## 3. Vendor Security Posture (Self-hosted OSS — supply chain)

### 3.1 Compliance and certifications

| Standard | Applies? | Notes |
|---|---|---|
| SOC 2 / ISO 27001 (DocuSeal Cloud) | N/A to CBB | DocuSeal's hosted offering reports SOC 2 / ISO 27001, **but CBB does not use the hosted service** — so the relevant posture is CBB's own Azure SOC2/ISO inheritance (see Azure Security Review), not DocuSeal's. |
| eIDAS (EU) / ESIGN (US) | Yes | Self-hosted DocuSeal provides the audit trail + cryptographic sealing for legal validity under ESIGN/eIDAS. |
| AGPL-3.0 license compliance | Yes | CBB runs unmodified upstream images. **Confirm no redistribution obligations are triggered** (internal use of unmodified AGPL software does not trigger source-provision; document this position). |

### 3.2 Data processing agreement

- [x] **N/A** — no third-party processor. CBB is both controller and (self-hosted) processor. No DPA required for the DocuSeal *software*; Azure's DPA covers the hosting layer.

### 3.3 Supply-chain / vulnerability posture

- Source: `docusealco/docuseal` (AGPL-3.0, Ruby). ~6K GitHub stars, active project.
- **Container image provenance:** confirm CBB pins a specific, verified image tag/digest (not `latest`) and tracks upstream CVEs.
- **Patch cadence:** define who watches upstream releases/security advisories and how images are rebuilt/redeployed (Terraform-managed).

### 3.4 Security documentation

- [x] Upstream project publishes self-hosting + security guidance
- [x] Public GitHub issue tracker / advisories
- [ ] No first-party SOC 2 for the self-hosted path (expected — it's your deployment; covered by Azure)

### 3.5 Authentication and access control

- [x] DocuSeal admin account — credentials in `kv-cbb-shared-prod` (`docuseal-admin-password`)
- [x] Reads all runtime secrets from Key Vault via **managed identity** (DB URL, secret-key-base, storage key, SMTP password, admin password)
- [x] Container App environment static outbound IP allowlisted at Key Vault and PostgreSQL

---

## 4. Hardware Security Assessment

**N/A** — software.

---

## 5. Integration Security

### 5.1 Credential management

All DocuSeal secrets in `kv-cbb-shared-prod`, read at runtime via managed identity — none in code/config:

- [x] `docuseal-database-url` (PostgreSQL connection, `cbbadmin`, private FQDN, `sslmode=require`)
- [x] `docuseal-secret-key-base`
- [x] `docuseal-storage-key` (blob account key)
- [x] `docuseal-smtp-password`
- [x] `docuseal-admin-password`
- [x] `app-docuseal-sharepoint-cert-pfx` (Entra app reg for the OneDrive move; exp 2027-06-08 — **rotation reminder**)

### 5.2 Network exposure

- DocuSeal runs as `ca-docuseal-prod` in VNet-injected `cae-cbb-prod`; scales to zero when idle.
- Public HTTPS ingress via the Container App (managed cert `cert-docuseal-esign`) — **confirm it is the only public surface and is restricted appropriately** (signer access requires reachability, so it is internet-facing by design; consider IP/identity restrictions if signers are internal-only).
- DB access is VNet-private (private DNS zone); blob is private (key-based, no anonymous).
- OneDrive move via Logic App managed identity to Microsoft Graph — no licensed user account.

### 5.3 Offboarding plan

DocuSeal is CBB-owned infrastructure (Terraform). To decommission: destroy the Container App + supporting resources via Terraform, delete the DocuSeal secrets from Key Vault, retain signed PDFs (already in OneDrive system of record), and drop the `docuseal` PostgreSQL database. No third-party data deletion needed (nothing is held externally). Open-source means no contract lock-in.

---

## 6. Risk Summary

| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Public DocuSeal endpoint exploited (unpatched OSS CVE) | M | H | Pin verified image digest; track upstream advisories; scale-to-zero reduces window; restrict ingress if signers internal-only |
| Legal-document / signer-PII exposure | L | H | All data in CBB-controlled Azure (VNet-private DB, private blob) + OneDrive; managed-identity secret access; no third party |
| Entra app-reg cert expiry (2027-06-08) breaks OneDrive move | M | L | Calendar the rotation; documented in runbook |
| AGPL redistribution obligation misunderstood | L | M | Run unmodified upstream; document internal-use position; legal confirm if ever modified/redistributed |
| Secret sprawl | L | M | All secrets in Key Vault via managed identity; none in code |

**Overall risk rating:** **Medium** — self-hosting moves patch/exposure responsibility to CBB; the public signing endpoint + OSS patch cadence are the real risks. Data-custody posture is strong (all in-house).

**Recommendation:** **Approve with conditions** — pending Founder sign-off.

**Conditions:**
1. Pin a specific verified container image digest (not `latest`) and assign upstream-CVE watch responsibility + redeploy cadence.
2. Confirm the public Container App endpoint is the only public surface; restrict ingress if signers are internal-only.
3. Calendar the `app-docuseal-sharepoint` cert rotation (exp 2027-06-08).
4. Document the AGPL-3.0 internal-use position (no redistribution).
5. Add DocuSeal to the "CBB Risk Register" SharePoint List.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/DocuSeal/DocuSeal_Security_Review.md` |
| **Cross-references** | `DocuSeal_Architecture_Reference.md`; `DocuSeal_Acquisition_Brief.md`; `Azure_Security_Review.md`; `Azure_Key_Vault_Architecture_Reference.md`; "CBB Risk Register" SharePoint List |
| **Created** | 2026-06-09 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-09 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-09 | Claude Code | — | — | Initial draft. Framed as self-hosted OSS (not SaaS): assesses supply chain + CBB deployment posture, not a vendor's data handling. Documents in-house data custody (VNet-private PostgreSQL, private blob, OneDrive SoR), managed-identity secret access, AGPL-3.0 position, and public-endpoint/patch-cadence risks. Recommends Approve with conditions. Version number to be assigned by Founder. |
