Everything you need to run Docurensic

What Docurensic is

Docurensic is a document forensics service. Upload a PDF, Office file, email, image, or archive and it inspects the file the way a document examiner would — metadata, fonts, revision history, embedded images, signatures, and the numbers on the page — then returns a plain-English report with a forensic evidence score and a clear operational action. Everything works from your browser — no install, no plugin; documents are analyzed server-side in isolated processing.

Run your first scan

Three steps. Simple files often finish in seconds; large or complex files can take longer. Everything happens from the Documents page — the first item in the sidebar.

AI analysis when document text is available

Every scan runs the applicable forensic engines. When bounded native or OCR text is available, it also runs an independent AI-powered review — there is no depth selector or AI tier to choose. A no-text document reports that the review was unavailable instead of calling a model with empty input. AI never changes the forensic score or verdict.

Reading your report

The report leads with one operational action while keeping forensic authenticity, file threat, account policy, and advisory AI visibly separate.

Finding your way around

The sidebar groups everything into Workspace, Analysis, and Organization.

Automate what happens next

Docurensic doesn't stop at the verdict — you decide what happens next once, and it runs on every document after that, no code. In the visual Workflows builder you write rules as when a document event happens, if it matches your conditions, then run steps — alert a channel, tag, quarantine, open a case, run a tool, or hand off to another workflow. Save your Slack channels, email lists, cloud folders and webhooks once in Connections and reuse them by name, and let new files from a watched Dropbox or Drive folder analyze themselves.

The full trigger, condition and action catalog — with branching, schedules, formulas and connectors — is in the Automation tab.

What Docurensic checks

Multiple forensic categories, dozens of individual signals. Most tampering leaves traces across more than one.

Six engines, one report

Every upload is routed by file type to the engines that understand it. All write to the same normalized report shape. Findings remain isolated as authenticity, threat, AI-content, identity, or account-policy information before one decision contract produces the operational action. Each engine is import-guarded and failure-isolated — a missing dependency or runtime error degrades that one engine, never the whole scan.

PDF forensics engine

Runs on every .pdf upload. Every check is isolated — a single failing check is recorded as an error and never crashes the request.

Multi-format engine

Handles everything that isn't a PDF: Office documents (including macro-enabled variants), email, archives, spreadsheets, and standalone images.

AI / content-trust engine

A separate detector for synthetic content and unsafe links, run automatically on image uploads and available directly for text/URL analysis.

Recognition & fusion engine

A second opinion on document type and authenticity, fused from up to eleven independent sources — each optional, each skipped gracefully if its dependency isn't installed. A type verdict is corroboration-gated: two sources agreeing produces high confidence; a single source is capped and flagged uncorroborated_type.

Field & type engine

Runs inside every scan. Extracts typed business fields, commits to a document type only when independent evidence corroborates (declining to guess otherwise), and tracks per-vendor term drift over time. Its output populates the report's document-identification and field-analysis blocks.

Cross-document intelligence

Runs after every scan, comparing the current document against prior submissions — intentionally not scoped to a single account, since fraud rings span customers.

Format coverage

The formats the engines accept — routed automatically by extension and magic bytes, so a disguised file is scanned as what it really is, not what it claims to be.

Forensic authenticity, threat & final action

Authenticity evidence, file danger, and account handling policy remain separate, so a phishing email, a forged invoice, and a routing rule are never conflated into one score.

Check catalog

Every signal category the engines can raise, with the number of distinct checks in the source that can raise it — computed live from the running code (GET /api/checks), not a hand-maintained figure that can drift.

Standalone tools

Beyond the full scan, Docurensic ships focused single-file tools — small forensic labs and a PDF workbench you point at one document, link, or company. They all open from the Tools page (sidebar → Analysis), and most can pull a file straight from your File Vault so you don't have to re-upload. Jump to one:

Files, cases & your workspace

Where your documents live, how you group them, and where decisions and activity show up.

Smart Workflows — decide once, run on every document

Docurensic doesn't stop at the verdict. In the visual, no-code Workflows builder you write rules as WHEN something happens, IF it matches your conditions, THEN run these steps — and it runs automatically on every document after that. Jump to a section:

The WHEN / IF / THEN model

Every workflow reads the same way. WHEN picks the moment (a document finishing analysis, a human decision, a timer, or a manual run). IF is a set of optional filters, all AND-ed together — leave them empty to act on everything. THEN is a tree of steps that runs in order: each step is an action or a conditional split.

Triggers — the WHEN

The event that starts a workflow. Most derive from a finished scan; two run on their own.

Conditions — the IF

Optional filters, all AND-ed together. Leave them empty and the workflow acts on everything the trigger catches; add a few to narrow it to exactly the documents you care about.

Actions — the THEN

What a workflow does, grouped into five families. Message actions can reuse a saved Connection instead of a pasted URL, and support formulas like {{filename}}.

Branching — one flow, many paths

The THEN side is a step tree, not just a flat list. Any step can be a conditional split: several labelled paths, each with its own condition, plus an optional "Otherwise". Only the first path whose condition matches runs — exactly like a switch — then the flow continues past the split. Splits can nest up to three levels deep.

WHEN   Analysis completed
THEN   split on:
         ┌ High risk (score ≥ 75)   → create case + alert #fraud
         ├ Needs review             → tag "to-review" + email the queue
         └ Otherwise                → move to "Cleared" folder

A plain list of actions with no split validates and runs the same way, so branching is entirely optional. Limits keep flows readable: up to 10 top-level steps, up to 6 paths per split, and up to 40 actions across the whole tree.

Schedules & waiting

Test it before you trust it

Three safe ways to try a workflow without waiting for a real document to trip it.

Start from a template

You rarely start from a blank canvas.

Formulas — put document data in your messages

Every message field — notifications, emails, chat and webhook messages, notes, case titles — supports formula tokens of the form {{field|filter:arg}}. An insert-data picker in the builder means you don't have to type token names.

🚩 {{filename}} — {{doc_type|title}} — scored {{risk_score}}/100
Verdict: {{verdict|upper}}   Amount: {{amount|currency:$|number}}
Review it: {{report_url}}

Fields include document facts ({{filename}}, {{doc_type}}, {{amount}}, {{tags}}), analysis facts ({{verdict}}, {{risk_score}}, {{threat_level}}, {{report_url}}), run facts ({{workflow}}, {{date}}), and the scheduled digest stats above. Filters chain after a pipe: upper, lower, title, round:1, currency:€, number (thousands separators), truncate:40, and default:none. A known field with no value shows an em dash, a typo'd token stays visible so you can spot it, and a broken formula never sinks the message.

Connections — set a destination once, reuse it everywhere

Save a URL or token once on the Connections page and every workflow can reference it by name — update the connection and every flow that uses it updates too. Each saved connection has a one-click test ping, and secret fields (like bot tokens) are write-only.

Integration API (API keys)

The supported, stable way to run Docurensic from your own systems. It is a small, analysis-only surface under /api/v1, authenticated with an API key — separate from the browser session endpoints documented further down this page.

Getting a key

Open Settings → API access, turn on Enable API access (the master switch — while it is off, every API request returns 403), then click Generate key. The key (drk_live_…) is shown once — store it securely; only a SHA-256 hash is kept server-side. Regenerate or revoke it in Settings at any time; the previous key stops working immediately. Send it on every request as Authorization: Bearer drk_live_… or X-API-Key: drk_live_….

curl -s https://docurensic.com/api/v1/analyze \
  -H "Authorization: Bearer $DOCURENSIC_API_KEY" \
  -F "[email protected]"

Same accepted types and 150 MB limit as the app. The call is synchronous — typical latency is tens of seconds for the full forensic + AI pass. The response is the fixed v1 document payload (verdict, score, the decision contract, document type, and the slim case-file answers). Full field-by-field reference: the API guide shipped with your deployment.

Application endpoints (browser session)

Every feature in the app is backed by a REST endpoint under /api. These are the app's own browser surface — authenticated with a Supabase session token, not an API key — documented here for reference. For programmatic integration from your own systems, use the Integration API above. Requests and responses are JSON unless a file upload is involved (then multipart/form-data).

Authentication

Docurensic uses Supabase Auth. Sign in to obtain an access token, then send it as a bearer token on every request. Tokens are verified server-side (with a 60-second in-process cache). A handful of reference endpoints are public — they're marked public below.

curl https://docurensic.com/api/scan \
  -H "Authorization: Bearer <your-access-token>" \
  -F "[email protected]"

Docurensic in your business

Docurensic ships tuned profiles for the document types that carry the most fraud, and industry rule packs that layer sector-specific checks on top. You can pin your workspace to an industry in Settings → Industry preset (auto, freight, insurance, lending, legal, or hr), or leave it on auto-detect. The scenarios below are grounded in the actual doc-type profiles and cross-document intelligence the engines run.

Make detection fit your workflow

Every account scans with the same calibrated engine, but no two document flows look alike: a freight broker's rate confirmations, a lender's bank statements, and an HR team's diplomas carry different "normal". The Detection panel on the Settings page lets you tune what gets flagged, how strictly verdicts are drawn, and what your own business rules add on top — without ever weakening the core forensics. The controls below are read-only until you flip the Custom engine settings switch at the top of the Detection panel — the sensitivity dial applies either way, and while the switch is off the engine runs on its calibrated defaults.

Your business rules, as formulas

Custom rules let you express policy the engine can't know: which amounts matter to you, which vendors you trust, which document types deserve extra scrutiny. Rules are built in a visual formula builder — no code — from three ingredient types, and their outcome is always a separate policy action (tag the report, require review), never a change to the forensic evidence itself.

WHEN   document type is Invoice
IF     document total ≥ 10,000
AND    (font anomaly fired  OR  revision history fired)
THEN   require review  +  tag "large-invoice-check"

This rule never claims the invoice is forged — it records that your policy wants human eyes on large invoices with any typography or edit-history finding. The tag it applies is visible on the report, filterable in your history, and usable as a Smart Workflows trigger ("my custom rule matched") to alert a channel or route the document to a tool automatically.

Company profile and per-type overrides

Two more layers tailor scans to your paperwork rather than paperwork in general.

Your account

Signing in, configuring how scans behave, and managing your data. Everything here lives on the Settings page.

Scan settings

Configure how every scan behaves. These are the exact keys the PUT /api/account/settings endpoint accepts.

Privacy & security

Exporting & deleting your data

Frequently asked questions