Skip to main content

​
Upload and manage compliance documents

Settings → Compliance → Documents is your organization’s document library — a single place to upload identity, address, and business documents, then attach each one to any number of compliance profiles. The page also surfaces which documents your in-progress profiles still need so your numbers and sender IDs activate without a back-and-forth. For the API surface behind the page, read the compliance documents reference. This page is the operator’s walkthrough of the console.
Every document here is tenant-owned: you choose what to upload, which country to tag, and which profiles to attach it to. Devotel Orbit stores the files you submit — it does not mandate which documents your compliance posture requires. Confirm your requirements with counsel or your carrier’s registration guide before uploading.

​
What the page manages

The document library holds every file your organization has submitted for compliance purposes, whether it is a national ID card, a certificate of incorporation, a signed DPA, or a BAA execution record. Each document carries metadata that lets you reuse it across profiles: Accepted file types are JPEG, PNG, WebP, and PDF, with a 10 MB per-file limit.

​
Document types

The Type dropdown offers eleven document categories. Carriers and regulators ask for different combinations — the page lists every type so you can satisfy any requirement:
  • id_card — national identity card
  • passport — national passport
  • drivers_license — driver’s license
  • utility_bill — recent utility bill (proof of address)
  • bank_statement — recent bank statement (proof of address)
  • business_registration — certificate of incorporation or business registration
  • vat_certificate — VAT registration certificate
  • lease_agreement — lease or tenancy agreement
  • proof_of_address — other proof-of-address document
  • power_of_attorney — power of attorney letter
  • other — any other compliance document (DPA scan, BAA scan, privacy register artifact)
The type is metadata — it does not change how the file is stored or validated. Tag it to match what the profile asks for so the attachment resolver can match it to the requirement.

​
How to upload a document

​
Upload from the library

Open Settings → Compliance → Documents (/settings/compliance/documents).
  1. Choose the type. Select the document type from the dropdown — the one the carrier or your compliance profile is asking for.
  2. Choose the country (optional). Pick the issuing country from the full ISO-3166 country list. The picker floats your most-used countries to the top so the markets you file for are always within reach. Leave it blank if the document is not country-specific — for example, a signed DPA or a BAA execution record you uploaded for your own audit binder.
  3. Select the file. Click the file input and pick a JPEG, PNG, WebP, or PDF file under 10 MB. The upload begins immediately — no second button click. A spinner confirms the upload is in progress. On success the library refreshes and the new document appears in the table.

​
Upload from a compliance profile requirement

When a carrier or a registration flow tells you which specific document is needed — for example, “passport for Brazil” or “business registration for India” — the compliance profile page sends you to the document library with the requirement pre-filled. The page shows a banner at the top naming the requested document and country, the type and country dropdowns are pre-selected, and the form scrolls into view automatically. If the profile needs multiple documents, the banner shows a full checklist — every required document with a checkmark for ones already uploaded — so you can upload them all in one visit without switching back and forth. When you are done, click Back to your compliance profile to return and attach the new documents.

​
The library — search, filter, and manage

Once you have uploaded documents, the library table lists every file with its type, country, format, size, and upload date. You can:
  • Filter by type, country, or format using the search box at the top. As you type, the table narrows to matching rows — search on the raw type (id_card), the human-readable type (id card), the ISO country code (US), the country name (United States), or the MIME type (image/png).
  • Load more past the first 25 rows. Each click appends another page. The row count resets when the filter changes so you always land on the first matches.
  • Delete a document. Click the trash icon on any row, confirm in the dialog, and the file is permanently removed from the library and every profile it is attached to. The confirmation names the document type so you know exactly what you are removing.

​
Populating the privacy register and evidence binder

Documents uploaded to the library feed into two compliance workflows that need supporting files:

​
Privacy register (DSAR and Article 30)

Your privacy register records processing activities (Article 30 ROPA) and their Data Protection Impact Assessments (Article 35). When a processing activity references supporting documents — a signed DPA, a consent form template, or a cross-border transfer safeguard — upload them to the document library and attach them from the privacy register’s activity detail page. The same document can be attached to multiple activities: upload the signed DPA once, then reference it from every ROPA entry that depends on it. For the full walkthrough, see Run the privacy register and the DSAR workflow reference.

​
Evidence binder and trust center

The trust center evidence pack is the export-ready bundle your auditor or a customer’s security review asks for. Documents you upload — signed DPAs, BAA execution records, privacy register artifacts — appear in the evidence pack when they are attached to the profiles and activities they support. Upload the signed agreement to the library, attach it to the relevant profile, and it is included in the next evidence-binder export automatically. See Assemble your first evidence binder for the end-to-end walkthrough.

​
Trust center vs. workspace — how document roles differ

The trust center and your workspace handle documents for different audiences, and the library serves both: Upload a signed DPA or BAA to the library once. Attach it to the DPA or HIPAA profile, and it surfaces in both places: your workspace library for internal reference, and the trust center evidence pack for external sharing. The DPA console at Settings → Compliance → Data Processing Agreement and the BAA console at Settings → Compliance → BAA each produce their own signed PDFs through typed e-signature — those signed copies are separate from the library. If your procurement process produces a negotiated, counter-signed DPA outside the console — for example, a redlined agreement with custom SCCs — upload it through the library and attach it to the DPA profile so the trust center evidence pack includes it. For the lifecycle of the console-signed DPA and BAA, see the Data Processing Agreement reference and the BAA guide.

​
Examples

​
Upload a signed DPA for your GDPR posture

A DPA you accepted through the console at Settings → Compliance → Data Processing Agreement produces a signed PDF that stays stored as your encrypted legal record. If you negotiated a custom DPA with privacy@devotel.io and received a counter-signed PDF instead — or if the console-signed DPA is already on file and you want a copy in the library for your own audit binder — upload it through the document library:
  1. Open Settings → Compliance → Documents.
  2. Set Type to other.
  3. Leave Country blank (a DPA is not country-specific).
  4. Select the signed DPA PDF.
  5. The file lands in your library. Open your compliance profile — the one that governs GDPR posture — and attach it. The document is now in your evidence binder export for Article 28 audit requests.

​
Upload a BAA execution record for your HIPAA posture

The BAA console at Settings → Compliance → BAA produces an executed PDF after you type your e-signature. If your organization needs a copy of that execution record in the document library — for example, because your auditor wants every signed agreement in one place — upload the executed PDF:
  1. Download the executed BAA from the BAA console (Download signed PDF).
  2. Open Settings → Compliance → Documents.
  3. Set Type to other.
  4. Leave Country blank.
  5. Select the downloaded PDF.
Once uploaded, attach it to your HIPAA compliance profile. The next evidence binder export includes it under the HIPAA section, and the file is retained in your library alongside your KYC and identity documents.

​
FAQ

Who can upload, view, and delete documents? Documents are accessible to the organization owner and admin roles. Upload and delete require the same roles. Developers, viewers, and billing roles do not have access to the document library. What happens when I delete a document? The file is permanently deleted from storage. It is removed from every compliance profile it is attached to — profiles that required the document return to the “required” state and the operator must upload a replacement. The confirmation dialog names the document type before you confirm so you know exactly what you are deleting. Can I attach the same document to multiple compliance profiles? Yes. Upload a passport once, then attach it to every profile that needs it — one for a Brazil sender registration, one for an India DLT registration, one for a global identity verification. Deleting the document from the library removes it from all of them. Does the document library gate anything? No. The library is storage and attachment — it never blocks a send, a number purchase, or a profile activation on its own. A profile that requires a document stays in “action required” until a document of the matching type is uploaded and attached, but the library itself does not enforce that gate. What file types and sizes are accepted? JPEG, PNG, WebP, and PDF, up to 10 MB per file. Files larger than 10 MB are rejected at upload — resize or compress the file before uploading.
Last updated: October 2026 For questions about compliance documents, contact: support@orbit.devotel.io