Most vendors store your data on their infrastructure. We don't.
When you install Doc‑Salvage, storage is provisioned directly into your own Microsoft Azure subscription. Your documents never pass through BYBWE's infrastructure — not during upload, not during storage, not at any point. BYBWE has zero access to your data, and that's by design, not just by policy.
If you ever decide to stop using Doc‑Salvage, your data stays exactly where it is — in your Azure tenant. Nothing disappears, nothing gets deleted, and nothing is held hostage.
Full ownership, always
See and manage your storage directly from the Azure portal at any time. Everything you store remains yours.
Completely isolated
No shared storage pools between businesses. Your documents sit inside your own Azure environment, separated entirely from every other customer.
Enterprise-grade foundation
Built on Microsoft Azure Blob Storage — the same infrastructure that powers some of the world's largest organisations, in your own subscription from day one.
Identity through Microsoft Entra ID — the platform you already use.
No separate user database, no new login system, no additional credentials. Your team signs in with their existing workplace credentials, and the access controls you've already built carry over automatically.
Multi-factor authentication
If MFA is enabled in your Entra ID tenant, it applies to Doc‑Salvage with no additional configuration. You stay in control of your own authentication policy.
Straightforward admin controls
Add users, remove users, and create groups directly from Entra ID — the same place you manage the rest of your Microsoft environment.
Instant offboarding
When a user is removed from Entra ID, their access to Doc‑Salvage is revoked immediately. No separate offboarding step, no loose access to clean up.
Full audit trails
Admins get full visibility into user activity — who accessed what, when, and what actions were taken. If something looks unusual, the trail is there to investigate.
The full protection of Azure Blob Storage, inherited.
Here's what that means in practice for your business.
Encryption at rest
Every document is automatically encrypted inside Azure Blob Storage. No configuration required — encryption is on by default.
Encryption in transit
All data in motion is protected by TLS 1.2. Any request over an unsecured connection is rejected outright.
No anonymous access
Storage is locked to authenticated users only. No unauthorised party can reach your documents by guessing a URL.
Private endpoints
Traffic to your Azure Blob Storage never travels over the public internet — it moves through private network paths within your environment.
Threat detection
Microsoft Defender for Storage monitors in real time, flagging anomalies and alerting your subscription admins before they become incidents.
Deletion protection
Soft delete recovers accidentally deleted documents, and versioning keeps a history so previous versions can be restored. Resource Manager locks prevent storage accounts being deleted in error.
Integrations are powerful — and always on your terms.
Doc‑Salvage integrates with third-party applications, such as Xero, to support document processing workflows. But it never automatically shares your documents with any of them.
Third-party access only happens when you explicitly grant permission — scoped per application to exactly what it needs. An accounting integration like Xero only reaches the documents relevant to that workflow. Nothing more.
Built on infrastructure enterprises and regulators already trust.
By operating on Azure, Doc‑Salvage inherits its compliance certifications — maintained and updated by Microsoft on an ongoing basis. As they're renewed and extended, you benefit automatically, with no action required.
Confirms the underlying infrastructure follows internationally recognised standards for information security management.
Azure's security controls have been independently audited and verified by a third party — not just claimed.
Data handling meets European data protection requirements — a reliable foundation for businesses operating in or with the EU.
A smaller compliance surface for your business
Because BYBWE doesn't store customer data, your documents sit in your own Azure environment — governed by your own policies and covered by Azure's compliance framework, not a third-party vendor's.
Security should give your business confidence — not complexity.
Book a demo and we'll walk you through exactly how your data is stored, who can access it, and how your Azure environment stays in control throughout.
Have specific security questions? Reach us at hello@bybwe.com, or see the pricing page.