Managing vendor documents (the Docs vault)

For: an admin, especially anyone handling security or compliance documents. Takes about 5 minutes.

What this means

A tool's Overview tab has a single documentation link field. It holds one URL, usually pointing at the vendor's help center. That's not what this article covers.

The Docs vault is a different tab on the tool page, and it's a real file store. It holds the paperwork a security or compliance review actually asks for:

• SOC 2 reports;
• penetration test results;
• DPAs (data processing agreements);
• contracts;
• invoices.

It replaces the habit of saving vendor PDFs as attachments on a project-management ticket. There, nothing tracks when a document expires, and nothing tells you what's missing.

What you can do

From the Docs tab on any tool, you can:

• Upload a document. Drop a file, pick a type (SOC 2 Type II, Pen Test Report, DPA, Invoice, and more), and set an effective date. Stacktic prefills an expiry date from the type's default validity period, which is how long a document of that type normally stays valid. You can always change it.
• Categorize it. Every document type belongs to a category: Security, Compliance, Legal, Finance, or Operations. That keeps the table organized as it grows.
• Pin a document to a specific account. Most documents apply to the whole tool. But when a tool has more than one account, you can pin a contract or invoice to one of them. Two Linear workspaces with two separate agreements is one example.
• Mark a type as required. Add "SOC 2 Type II" or "DPA" to a tool's required-docs checklist. Stacktic then tracks whether a current one is actually on file, and flags it if it isn't.
• Jump to the vendor's trust center. A trust center is the page where a vendor publishes its security documents. When Stacktic knows where it is, a Vendor trust center ↗ link sits at the top of the Docs tab. It also appears on the Slack message and signal page when a document is expiring. So the current SOC 2 is one click away.
  • Stacktic looks the link up for you, and only keeps one that actually loads.
  • If it's missing or wrong, edit the tool and set Trust center URL under Advanced configuration.
  • That lookup never overwrites anything you enter.
• Replace an old version. Uploading a new report of the same type can supersede the old one. The old version isn't deleted. It moves into a collapsed version history, and you can still download it. So you can always answer "what did we approve against last year?"

Currency status

Every document shows one of four status pills. You don't set any of them by hand. Stacktic works them out from the dates you enter:

• Current: on file and not expired. This is what you want to see.
• Expiring: still current, but the expiry date falls inside the warning window.
• Expired: the expiry date has passed. An expired document does not satisfy a requirement, even though it's still on file.
• Superseded: a newer upload of the same type has replaced it. It's kept for the record, not for the checklist.

A required type with no current document shows as Missing on the required-docs card. That's true whether nothing was ever uploaded or the one document you had expired.

Who can see it

Every Owner, Admin, and User can see and manage a tool's documents. The tool registry shows nothing from this tab, not even that it exists.

A signed download link to a contract or a SOC 2 report is sensitive on its own. So every download is logged to the tool's Activity tab, the same way uploads, edits, and deletions are.