Skip to content
NG DMS
Access and isolation

Only those allowed see a document. Everyone else never learns it exists.

The organization is a boundary in the database itself: one organization’s data is never visible from another. Inside an organization, access is set by roles, owner and sharing, data scope and five confidentiality levels, and the same check applies wherever a document is read — in the list, search, counts, the palette and the viewer.

  • Isolation in the database
  • 5 confidentiality levels
  • SSO, SAML and LDAP/AD
  • TOTP and passkeys
Book a demoAll features
Interface illustration with sample data
Capabilities

Who may do what, in which organization

A right exists only where the layers intersect. The server decides every action, and the screen shows only what the server allows.

  • The organization as a boundary

    Every piece of business data belongs to exactly one organization, and isolation is enforced in the database, at row level. An automated test fails the build for any table without an isolation rule. A user works only in organizations they are a member of.

  • Roles per organization

    A functionality × privilege matrix, system roles for registry clerks, case officers, archivists, auditors and other positions, groups and direct rights. The same person can be a registry clerk in one organization and read-only in another.

  • Owner, sharing and scope

    A document has an owner and is shared with a user or group, to view or edit, with an expiry. A role’s scope gives “mine only”, “my unit”, “unit and below” or the whole organization, along the tree of organizational units.

  • Five confidentiality levels

    Public, Internal, Confidential, Strictly confidential and Personal data. From Confidential up, a document is invisible without a dedicated right, counts included; not even an administrator bypasses this layer. A strictly confidential document leaves a trail on every open, print and download.

  • Sign-in, SSO and a second factor

    OpenID Connect providers, sign-in through a trusted reverse proxy and Active Directory / LDAP per organization. A TOTP second factor with recovery codes, a mandatory-2FA policy and protection against password guessing.

  • “Why can’t I?”

    A refused action says on screen which layer of the check refused it and whom to ask, instead of a bare “no permission” — without revealing what the user may not see.

  • Administrator entry with a reason

    A tenant administrator enters an organization they are not a member of only with a written reason, a strip that cannot be closed and an 8-hour limit. During the entry, sensitive data stays hidden.

  • Permissions by document status

    A policy sets what is visible, editable and required in which workflow status, per document type and user group — a contract under approval is not changed along the way.

  • Passkeys, SAML 2.0 and AD groups

    Passkeys (WebAuthn) as a second factor and for passwordless sign-in, SAML 2.0, and mapping Active Directory groups to roles per organization.

How it works

Layers checked before every read

Access is an intersection, not a sum: a document is visible only when every layer allows it.

  1. 01

    Organization

    An isolation rule in the database. A document of another organization does not exist for the user, in search or in counts.

  2. 02

    Role

    Every action needs its own privilege. Seeing a screen is not the same as the right to edit.

  3. 03

    Basis

    Owner, a sharing entry for the user or a group, the role’s scope, or the policy for documents without an owner.

  4. 04

    Confidentiality

    From Confidential up, a dedicated right is required, and not even an administrator bypasses it.

What changes in practice

One check for every read

The list, detail, search, counts, palette, thumbnails and downloads use the same check. A test at build time fails any document read path that would bypass it.

Invisible means invisible

For a document without permission, the answer is the same as for one that does not exist. A reference to it reads “Private”, and a duplicate message never reveals its title.

No organization changes silently

If a membership ends mid-session, the next click leads to the organization choice with the reason. A document never moves between organizations; it is copied, with its origin recorded in both.

Frequently asked questions

Can two companies of the same group work in one NG DMS?

Yes, as organizations of one tenant. Their data is separated in the database, and a user can be a member of several organizations with different roles in each. A document never moves between organizations; it is copied, with its origin recorded.

Does an administrator see every document?

A tenant administrator has broader rights but does not see documents from Confidential up without a dedicated right. They enter an organization they are not a member of only with a reason that stays in the trail, and sensitive data stays hidden during that entry.

Can sign-in be connected to Active Directory?

Yes. Active Directory and LDAP are configured per organization, over an encrypted connection. OpenID Connect, SAML 2.0 and sign-in through a trusted reverse proxy are supported too, and AD groups map to roles per organization.

What does a user see without permission?

A document they may not see appears neither in the results nor in the counts. When an action is refused, “Why can’t I?” says which layer refused it and whom to ask.

How is personal data protected?

A document can carry the Personal data level, visible only to users with a dedicated right; every open, print and download of such a document is written to the access trail. Attributes marked as personal data are hidden from others and are not searched.

Related

Want to see how this looks in NG DMS?

We will show you in a demo, on examples from your own registry office — from the scan to NG Copilot’s answer. No obligation.

Book a demoMeet NG Copilot