Last updated: 25 July 2026. This notice is intended for institutions evaluating DocuShield. It should be read alongside our Privacy Policy and any signed data processing agreement.
1. Purpose of processing
DocuShield supports universities and admissions teams by helping verify student application documents, identify potential tampering or inconsistency, detect document fraud indicators, and produce explainable risk information for authorised reviewers.
2. Roles and responsibilities
For institutional product use, the university, college, admissions provider, or authorised organisation will generally determine why and how student application data is processed. DocuShield will generally process that data under the institution’s instructions as a service provider or processor, unless a separate agreement states otherwise.
3. Categories of data
Depending on the configured workflow, DocuShield may process:
- student identity and application reference information;
- uploaded documents such as transcripts, financial documents, English test records, certificates, and supporting evidence;
- document metadata, formatting signals, image characteristics, template indicators, and fraud risk markers;
- review notes, audit logs, verification status, and risk scoring outputs;
- institutional user account details and access logs.
4. Special category and sensitive data
Application documents may contain sensitive information depending on the document type and jurisdiction. Institutions should avoid submitting unnecessary sensitive data and should configure workflows, access controls, and retention rules to match their admissions and compliance requirements.
5. AI-assisted review
DocuShield’s AI analysis is designed to support human review, not to replace institutional decision-making. Risk scores, flags, and document signals should be reviewed by authorised personnel who can consider context, evidence, institutional policy, and applicant rights.
6. Security controls
DocuShield is designed around proportionate security safeguards for document verification workflows, including access control, secure transmission, role-based review, auditability, monitoring, and operational controls intended to reduce unauthorised access or misuse.
7. Access and confidentiality
Access to student application data should be limited to authorised users with a legitimate role in admissions, compliance, verification, support, or system administration. Personnel and service providers handling data should be subject to appropriate confidentiality obligations.
8. Retention and deletion
Retention periods should be configured or agreed based on institutional requirements, legal obligations, admissions timelines, audit needs, and applicant rights. Where DocuShield processes data for an institution, deletion and return of data should follow the applicable customer agreement or data processing instructions.
9. Data subject rights
Applicants and other individuals may have rights to access, correct, delete, restrict, object to, or receive information about processing. For institutional workflows, requests should usually be directed to the relevant institution, which is best placed to verify identity and respond in context.
10. International processing and subprocessors
Where hosting, support, or infrastructure providers are used, data may be processed by approved subprocessors. Appropriate contractual, technical, and organisational safeguards should be maintained for international transfers where required by applicable law.
11. Auditability and explainability
DocuShield aims to support transparent review by producing structured risk information, evidence signals, and workflow records. These outputs can help admissions teams explain review steps, focus attention on high-risk files, and maintain a compliance trail.
12. Contact
For data protection enquiries, institutional due diligence, or processor documentation requests, contact info@docushield.ai.