Data Privacy Impact Assessment
1. Purpose
This assessment identifies and evaluates the privacy risk associated with each data flow in the DocWright application, for use by institutional customers and their own data protection review processes.
2. Solution Overview
DocWright is a locally installed desktop application that remediates accessibility issues in DOCX, PPTX, and PDF documents. Processing occurs entirely on the end user's machine. The assessment below identifies every point at which data leaves that machine.
3. Data Flow Risk Assessment
| Data Flow | What Data | Where It Goes | Risk Level | Mitigation / Notes |
|---|---|---|---|---|
| Document upload & processing | Document content, potentially including FERPA-covered student data | Local only — never transmitted | None | No action needed; this is the default, lowest-risk path |
| License validation | License key and a random device identifier (no document data) | DocWright backend (Vercel) and seat database (Upstash, AWS us-east-1), HTTPS | Low | The identifier is random, not derived from hardware or the user. Seat checks fail open, so an outage never locks users out. |
| Update downloads | None beyond the ordinary download request | DocWright backend (application files) and GitHub release assets (LibreOffice and Python components), HTTPS | Low | Every update is verified against a SHA256 hash and an Ed25519 signature before it is applied. IT can pause updates through a registry policy. |
| Optional AI descriptions (alt text, equations) | Individual extracted images (a figure or equation), which could incidentally contain identifiable information (e.g., a photo, a name in a screenshot) | The AI provider the institution has configured (Anthropic, Google Gemini, or Azure OpenAI), via the institution's own API key, HTTPS | Low–Moderate | Institution can decline to provide an API key to disable this path. Under Anthropic's commercial API terms and Microsoft's Azure OpenAI terms, data is not used to train the provider's models. Google's Gemini API terms say the same for paid services, but allow unpaid (free-tier) use to be used to improve Google's products, so paid-tier keys should be used. Institutions may negotiate a Zero Data Retention arrangement (Anthropic) or modified abuse monitoring (Microsoft) directly with the provider. |
| Optional scanned-page transcription | The image of one full scanned or handwritten page per request, which may include handwriting, names, or other student work | The same configured AI provider, via the institution's own API key, HTTPS | Moderate | A separate, opt-in action ("Transcribe Pages"), never run automatically. Each transcription is shown to the user for review and editing before it is embedded. The institution can disable it by not providing an API key. The same provider terms and data-handling options apply as above. Because the whole page is sent, institutions should decide whether handwritten student work may be sent to their chosen provider. |
| Optional issue-report submission | Processed file name and a summary of issues found/fixes applied (never document content); plus whatever the submitting user manually types (name, department, contact email, issue description) | Google Forms, HTTPS | Low | Fully optional, user-initiated. No file-attachment capability exists on this form, so document content cannot reach this channel. |
| License/contact administration | Institution name, contact name/email/phone, license tier and term | Stored by Docwright Software LLC (administrative records) | Low | Retained only as long as needed to administer the license relationship |
4. Overall Risk Determination
DocWright's overall privacy risk profile is low relative to a typical cloud-hosted SaaS tool, because the highest-volume and most sensitive data — full document content, which may include FERPA-covered student work — is never transmitted off the local device under any circumstance. The limited data flows that do leave the device (license and update traffic, and the optional AI features) are narrow in scope. The AI flows are opt-in and governed by the institution's own agreement with its chosen provider rather than a relationship controlled by DocWright. Scanned-page transcription is the highest-exposure of these, because it sends a whole page image rather than a cropped figure, which is why it is a separate, opt-in action.
5. Recommended Institutional Controls
- If the institution wishes to eliminate the AI-related data flows entirely, do not provide an AI provider API key during deployment — all other accessibility remediation functions operate fully without it. DocWright does not currently enforce this centrally: a user can enter their own key or switch provider in Settings, so institutions that need to prevent this should address it in their acceptable-use policy.
- If the AI features are used, review the chosen provider's commercial API data retention and processing terms directly, since that relationship is between the institution and the provider. If Gemini is selected, issue paid-tier keys, because free-tier use may be used by Google to improve its products. Azure OpenAI retains prompts and outputs for up to 30 days for abuse monitoring unless modified abuse monitoring is approved. Consider negotiating a Zero Data Retention arrangement (Anthropic) or modified abuse monitoring (Microsoft) for additional assurance.
- The optional "Report an Issue" feature sends only a file name and processing summary to a Google Form, never document content; institutions with policies restricting file names containing identifying information may wish to note this in internal guidance to faculty.
- Apply standard device-level security controls (disk encryption, endpoint management) to machines running DocWright, consistent with the institution's existing device policy, since DocWright relies on the security of the local machine rather than a central server.
6. Related Documents
7. Contact
Gregory Buthusiem, Founder & Managing Member
Docwright Software LLC
(856) 817-5100