What DocRoute stores, where, and what leaves your org.
Written to be specific enough to answer your DPO or privacy team in one read.
Where data lives
All DocRoute data — templates, selection rules, generation jobs, and generated PDFs — lives inside your Salesforce org. There is no DocRoute cloud service, no shared database, and no off-platform processing tier for document generation. Data residency follows your Salesforce instance's residency (US, EU, AU, etc.).
Custom objects DocRoute writes
| Object | Purpose |
|---|---|
DR_Template__c | Customer-authored templates. Versioned. |
DR_SelectionRule__c | Rules-based template selection (criteria + priority). |
DR_GenerationJob__c | One record per generation request. Includes input parameters, selected template, status, and link to the resulting Salesforce File. |
DR_BrandTheme__c | Customer-defined brand themes (logos, color, typography). |
DR_AuditLog__c | Append-only. Every generation, e-signature dispatch, template publish, and rule change. |
Salesforce objects DocRoute reads
DocRoute reads only the records and fields you reference in your templates. Standard Salesforce field-level security, sharing rules, and object permissions apply.
- The target object on the originating record (Quote, Opportunity, Case, custom objects, etc.)
- Related records reached via template merge syntax (Account, Contacts, Line Items, related custom objects)
- Standard reference data (RecordType, User for createdBy/owner lookups)
What leaves your org
The base package makes zero outbound calls for document generation. The following are opt-in per template:
- DocuSign envelope dispatch (optional). The generated PDF plus a recipient list (signer names, emails, signing order) are sent to DocuSign via their REST API. The exact field-set is configured by you in the template's signature block.
- Adobe Sign agreement dispatch (optional). Same shape — PDF + signer list to Adobe via their REST API.
- Custom PDF renderer endpoint (Growth+, optional). If you configure a custom renderer, the template payload is sent to your endpoint instead of the built-in renderer. Your endpoint, your contracts.
What enters your org
- E-signature webhook callbacks. DocuSign Connect and Adobe Sign
webhooks post envelope status updates (sent / viewed / signed / completed / declined)
to a dedicated DocRoute Apex REST endpoint inside your org. The webhook resource
verifies the signature before applying the update to the related
DR_GenerationJob__c.
Telemetry
DocRoute collects no telemetry. We don't see your templates. We don't see how many documents you've generated. We don't see your customer data. If you need help, you can export the audit log or a specific generation job and share it on your own terms.
Retention
- DocRoute records (templates, rules, generation jobs, audit log, generated PDFs in Salesforce Files) follow your Salesforce data retention policy. They are not deleted by the package.
- Customers running into Salesforce storage limits can archive older generations via standard Salesforce data archive tools — the package does not require historical data to operate.
Sub-processors
None for the base package. When you enable e-signature dispatch, your selected provider (DocuSign or Adobe) becomes a sub-processor for the PDFs you choose to send. They are governed by your existing data processing agreements with those providers, not by oCino Ventures.
Backup and disaster recovery
DocRoute inherits your Salesforce org's backup and DR. The customer is responsible for backing up Salesforce data (including DocRoute custom objects and generated PDFs in Files) according to their own retention policy.
Questions? Reach out.