Document Vault
Upload the documents you already have. Aegis reads them and suggests vendors, risks, facts and assessment answers, and nothing reaches your program until a person approves it.
Most teams already have some of their program on paper: a security policy, a vendor spreadsheet, an old risk register, an architecture diagram. The Document Vault reads those documents and turns what they say into suggestions for your program. You review each one. Nothing is written to your organisation until a person approves it and applies it.
You find it under Compliance → Vault. While your assessment is still open, the assessment also points you to the Vault.
Uploading
Drop files onto the Vault page.
| What | Detail |
|---|---|
| File types | PDF, Word (.docx), Excel (.xlsx, .xls, .xlsm), CSV, plain text, Markdown, and PNG, JPEG or WebP images |
| Size | Up to 100 MB per file, up to 10 files at a time |
| Not supported | Legacy Word .doc: save it as .docx or PDF first |
Documents you uploaded earlier to the questionnaire knowledge base also appear in the Vault, marked Not analysed. Run Re-analyse on any of them to get suggestions.
What the analysis does
Each document is analysed in the background. The status moves through classifying and finding items, and suggestions appear as they are found.
Reads the text
Aegis extracts the text, including from images, and adds the document to the same knowledge base that drafts your questionnaire answers.
Classifies the document
As a policy, contract, vendor list, risk register, handbook, architecture document, audit report, screenshot, or other.
Suggests items to add
Depending on the kind of document:
- Vendors, from contracts, vendor lists and architecture documents.
- Risks that the text names explicitly. If the document states how a risk is mitigated, that becomes the suggested treatment.
- Facts about your organisation, such as where data is hosted.
- Assessment answers, but only for questions that a person (or an integration) hasn't already answered.
Checks every suggestion against the document
Every suggestion carries a quote from the document, and Aegis checks that the quote really is in the text. Suggestions whose quote it cannot find are dropped.
Matches what you already have
Suggestions are compared with your existing vendors, risks and facts. A match becomes an update, and each changed field is shown, for example "Will change Website from old-acme.com to acme.com".
Documents fill gaps. They never override an answer a person gave or confirmed in the assessment. If someone answers a question between analysis and apply, their answer wins and the document's suggestion is not applied ("Answered by a person after analysis").
Very long documents are analysed up to roughly the first 180,000 characters, and the document is flagged as truncated.
Reviewing suggestions
Open a document and choose Review proposals. Suggestions are grouped by kind: vendors, risks, facts and assessment answers.
- Approve one suggestion, a whole group, or everything at once.
- Edit a suggestion before approving it, for example to correct a vendor's description or mark it as a sub-processor.
- Reject a suggestion with a short reason. Rejected suggestions are not proposed again when the document is re-analysed.
- Suggestions that would change nothing are collapsed as No changes.
Applying
Apply N approved writes the approved suggestions to your program and reports the result for each one.
| Suggestion | What applying does |
|---|---|
| Vendor | Creates the vendor, or updates the matched one. A new vendor triggers Aegis's vendor research |
| Risk | Adds the risk to your risk register. Applying the same suggestion twice does not create a duplicate |
| Fact | Saved as organisation context that Aegis uses to tailor your program |
| Assessment answer | Written to the assessment, which shows "From" and the document's name under the answer |
Applying needs a signed-in person, and each item checks that person's own permission: someone who can't create vendors can't apply a vendor suggestion.
Re-analysing and deleting
- Re-analyse runs the analysis again, for example after the risk settings change. Suggestions you already rejected or applied are not proposed again.
- Delete document removes the original file and its extracted text. You can't delete a document while it is being analysed. Vendors, risks, facts and answers you already applied stay in your program; an applied assessment answer then shows "From a deleted document".
Risk suggestions by document type
NexusVoid administrators control which document types suggest risks, with a platform default per type and an override per organisation. Every type suggests risks by default, and risk registers always do. A change applies to the next analysis, so re-analyse a document to see its effect. If you want risk suggestions turned off for some document types in your organisation, ask us.
Who can do what
| Role | Vault access |
|---|---|
| Owner, Admin | Upload, review, apply, re-analyse and delete |
| Auditor | Read only |
| Employee, Contractor | No access |
| Custom roles | Whatever their vault permission allows. Existing custom roles have no Vault access until an admin grants it |
API keys can be given Vault read and upload access. Reviewing and applying suggestions always needs a signed-in person.
Your AI agent can cite analysed Vault documents when it proposes assessment answers: a document-sourced answer must quote a passage that really appears in the document.
What it does not do yet
- Policy import. Uploading a policy does not yet create a draft version of the matching Aegis policy. To use an existing signed-off policy, upload its PDF on the policy itself.
- Evidence matching. An audit report or screenshot is not yet attached to the evidence task it proves. Attach evidence on the task.
- Vault tools for agents. Your agent cannot yet upload to or search the Vault over MCP.
- Links back from entities. A vendor or risk page does not yet list the documents it came from.
- Folders. The Vault is a single list; documents are filed by type, not into folders you manage.
Next steps
Security Assessment
Where document-sourced answers land.
Vendor & Third-Party Risk
What happens to the vendors you apply.
Risk Management
The register your applied risks join.
Security & Data Handling
How Aegis handles the documents you upload.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com