The document workflow glossary.

21 CFR Part 11

An FDA regulation governing electronic records and electronic signatures in life-sciences workflows (clinical trials, quality, manufacturing).

AI assistant (document)

An LLM-powered Q&A surface that answers questions about uploaded documents with cited sources, refusing when no source supports the answer.

Audit trail

An immutable log of every action (view, edit, sign, share) on a document or workspace, exportable as CSV or streamed to a SIEM.

BYOK (bring your own key)

A privacy mode letting customers supply their own LLM API key, controlling routing, retention, and billing for AI features.

Click-through NDA

An NDA presented as an accept-or-decline modal before a recipient accesses a document, with timestamp and IP captured for audit.

Data room (VDR)

A folder-permissioned, audit-logged virtual workspace for sharing sensitive documents during fundraising, diligence, or M&A.

Digital signature

A cryptographic technique that binds a signer's identity to a document hash, providing tamper-evidence and non-repudiation.

Document analytics

Per-page tracking of dwell time, scroll depth, and re-reads on shared documents, telling senders which content actually got attention.

DPA (Data Processing Agreement)

A contract required by GDPR Article 28 between a Controller (customer) and Processor (vendor) defining how personal data is handled.

eIDAS

EU regulation 910/2014 governing electronic identification and trust services, including electronic signatures with three tiers: simple, advanced, and qualified.

Electronic signature

A digital mark applied to a document indicating consent or approval, court-enforceable under eIDAS (EU), ESIGN, and UETA (US).

ESIGN / UETA

US laws establishing the legal validity of electronic signatures and records: ESIGN at federal level (2000), UETA at state level (49 states + DC).

GDPR

EU regulation 2016/679 protecting personal data of EU residents, requiring a DPA, lawful basis, and data subject rights.

HIPAA BAA

A Business Associate Agreement required when handling Protected Health Information (PHI) under the US Health Insurance Portability and Accountability Act.

Interactive proposal

A web-native (not PDF) sales document with live pricing, ROI calculators, embedded video, and an accept-and-sign block.

Investor update

A periodic written communication to investors covering KPIs, highlights, lowlights, hires, and asks, typically monthly for early-stage, quarterly for late-stage.

KYC

Know Your Customer, identity verification required for financial services, often paired with AML (Anti-Money Laundering) checks.

MSA (master services agreement)

An overarching B2B contract defining payment terms, IP, liability, and termination, with deal-specific SOWs attached.

NDA (non-disclosure agreement)

A binding contract restricting disclosure of confidential information between two or more parties.

OCR

Optical Character Recognition, extracting text from images or scanned PDFs so they become searchable and AI-queryable.

SAFE (simple agreement for future equity)

A Y Combinator-developed convertible instrument used by startups to raise capital without setting a valuation.

SAML SSO

Security Assertion Markup Language single sign-on, a federation protocol letting users authenticate via their identity provider (Okta, Azure AD, Google).

SCIM

System for Cross-domain Identity Management, a standard for automated user provisioning, group sync, and deprovisioning from an identity provider.

Session replay

A recording of a visitor's interaction with a document, scroll position, page navigation, time per page, replayable as a timeline.

SOC 2 Type II

An annual independent audit covering Trust Services Criteria, security, availability, processing integrity, confidentiality, and privacy, required by most enterprise buyers.

SOW (statement of work)

A deal-specific agreement attached to an MSA, defining scope, deliverables, timeline, and pricing for a single engagement.

Watermark

A semi-transparent overlay on document pages (often the recipient's email) used to attribute leaks and discourage redistribution.

Webhook

An HTTP callback triggered by an event in one system, delivered to a URL in another, typically HMAC-signed and replay-capable.

White-label

A vendor mode where the customer's brand replaces the vendor's across every user-facing surface, domain, logo, type, color, transactional emails.

Zero-retention AI

An AI provider mode where prompts and responses are not persisted beyond the request lifecycle and never used for model training.