How booking documents work
Saudaflow keeps the paperwork on the booking, not in a folder. Every document is a row with a status somebody set, a desk that owes it and a version history nothing overwrites. This page is the map: what appears, what the statuses mean, who may move them, and what actually protects the files.
- Where this is
- Open a booking → the Documents tab. Identity documents sit on the Customer Wall tab of the same booking — one table underneath, split by category.
- Who can see it
- Anyone with documents · view whose data scope includes that booking. A seat that cannot open the booking cannot reach its files by any other route.
The checklist is created with the booking.
You do not add documents one at a time to get started. The moment a booking exists, Saudaflow writes one row per document for that kind of sale. A loan-linked booking also gets the tripartite agreement and the sanction letter. An NRI buyer also gets passport and visa / OCI / PIO. A resale adds the prior ownership chain. A rental gets a short list of its own. The checklist is a setting, so your admin can replace it with yours.
- 01Booking formSales
- 02Allotment letterLegal
- 03Agreement for SaleLegal · clears the RERA advance flag
- 04Tripartite / NOCLegal · loan cases
- 05Sale deedLegal
- 06Possession letterPost-sales
- Beside the chain: demand letters, the loan sanction letter and the loan file. Anything else your process needs is a custom row you add on the booking.
- On the Customer Wall: PAN, Aadhaar or an alternate ID, photograph, address proof, bank proof, specimen signature and the communication & data consent — plus income proof when there is a loan, and passport with visa / OCI / PIO for an NRI buyer.
- One row per document, per booking. The database will not accept a second allotment letter on the same booking, so “which one is current” is never a question — it is the latest version of the only row there is.
Two machines, both forward-only.
A status is something a person set, and the product only ever offers the moves that are legal from where the document is now. Try to skip one through the API and it refuses in plain English: “A paperwork item cannot move from PENDING to SIGNED.”
Paperwork
- Pending
- Drafted
- Under review
- Signed
- Registered
- Rejected
- Returned for correction
- Archived
Registered needs the registrar’s number. Marking a document Registered without one is refused with exactly that reason, because the number is the whole point of the state. Rejected and Returned for correction both walk back to Drafted, so a correction is a new version of the same row, not a new row.
Identity (KYC)
- Pending
- Collected
- Under review
- Verified
- Rejected
- Returned for correction
- Expired
Identity has its own machine because “verified” and “signed” are not the same word. Verified records who checked it and when. Expired is a real state with a way back — an expired ID returns to Collected when the buyer sends a current one.
The one status that changes something outside this tab
Marking the Agreement for Sale as Registered sets the booking’s agreement flag and clears the RERA Section 13 advance warning that has been sitting on the payment ledger. It writes its own activity line and its own audit row. Nothing about that step is silent, and no other document does it.
Signing off is a different permission from working on it.
- Marking a document Signed or Registered needs documents · publish. These are the two customer-facing, final states, and Registered clears the RERA flag for everyone on the booking.
- Every other move — sending for review, recording a review verdict, returning for correction, verifying a KYC item — needs documents · edit.
- Scope is checked on the booking first. The permission answers “may this role move a document”; the scope answers “is this booking yours to touch”. A booking outside your scope returns the same not-found a stranger gets, so the refusal never tells you a record exists.
- Two people on the same row. The move is written against the status you were looking at. If a colleague moved it a second earlier, you get “This document changed status a moment ago — reload and try again” instead of quietly overwriting them.
- Legal remarks can be withheld. The compliance note on a document is a field-level permission: a seat without it gets the document with that field empty, not a masked string.
Nothing is overwritten, and that is a database grant.
Each file you upload joins the document as the next version — v1, v2, v3 — with your name, the time, your note and the status the document was in when it arrived. The earlier ones stay downloadable.
- The first file on a Pending row moves it along by itself. Paperwork goes to Drafted, an identity document goes to Collected, and the move is logged as “Auto-moved on file upload”. There is no separate step to remember.
- The application cannot rewrite history. On the attachments table the app role holds SELECT and INSERT and nothing else — no UPDATE, no DELETE. A corrected agreement is v3; v2 is still there.
- A version note is read by the next person. “Corrected the carpet area in clause 4 and re-scanned page 2” is what a reviewer sees in the drawer six weeks later.
Access control the database enforces — not per-file encryption.
An earlier version of this page said every document was encrypted at rest with its own key, bound to the deal. That was not true and has been removed. Documents are stored as ordinary files on our own server. What keeps them yours is four things that are true, and you can check every one of them against how the product behaves.
- Row-level security, forced, deny by default. Every query for a document or an attachment runs inside your organisation’s context. It is Postgres that refuses a row belonging to another tenant, not application code that might forget.
- The path is generated by the server. A stored file lives at attachments/<your org id>/<random id>.<ext> and the extension comes from what the bytes actually are. The name on the file you uploaded is kept for display and never becomes part of a path.
- Reading a file re-proves the booking. Asking for an attachment by id resolves the document it hangs off, then the booking, then your scope on that booking. There is no side door into a record you would otherwise get a not-found on.
- Every move is audited. Who, what it was before, what it is now, the time, the IP and the request id — for status moves, version uploads and e-sign hops alike.
Said plainly, because you may have read otherwise
Booking documents are not encrypted file by file, and there is no separate cold storage tier. The one thing in Saudaflow sealed with its own key is a call recording. If your compliance team was told otherwise about paperwork, they were told wrong — and we would rather you learn it here than from an auditor.
What is true: the files sit on the application server, the database is backed up nightly, and access to any of it is scoped and logged.
Give a document a due date and it chases itself.
A required document past its due date notifies the person who owns the booking, once a day, and the notification opens the booking. Eight overdue documents on one booking produce one line naming the oldest and counting the rest — not eight lines. The check runs every quarter of an hour, so a date you set this morning is live this morning.
There is no organisation-wide rule today along the lines of “documents are due 30 days after booking”. The due date is per document, set on the row.
What this module does not do.
Four things people expect from a documents module, which Saudaflow does not have today. Better here than after you have promised one to a buyer.
-
No e-signature provider
Nothing sends a document for Aadhaar e-sign, and no provider is wired in. What exists is a signing workflow you drive, which is genuinely useful — see how to track one.
-
No share links
There is no expiring URL, no read-once mode and no watermark. A buyer reads their own paperwork by signing in to Buyer Connect — how that works.
-
No documents screen in the field app
The Android app does leads, calls, site visits, inventory and approvals. The document wall is a web screen. On a phone, open it in the browser.
-
No inbound e-mail, no auto-filing
You cannot forward a scan to an address and have it land on a booking, and nothing reads a PDF to decide which document it is. A person picks the row and uploads the file.
Asked on this tab.
Are our documents encrypted?
Not file by file, and we will not say otherwise. Booking documents are stored as ordinary files on our own server, under a path the server generates. What protects them is access control the database enforces: row-level security is enabled and forced on every table involved, reading a file re-proves your scope on the booking it belongs to, and every read and every move is audited.
The one thing in Saudaflow encrypted with its own key is a call recording, which is a different module with a different threat model. An earlier version of this page claimed the same construction for documents. It was wrong.
Can I delete a document or a version?
No, and that is deliberate. The application holds insert and read rights on attachments and nothing more, so neither a user nor a bug can rewrite what was filed. A document that should no longer be worked on moves to Archived; a file that was wrong is superseded by a new version with a note saying what changed.
Can I add a document that is not on the checklist?
Yes. Add a custom row on the booking with your own title and the desk responsible; it gets the same status machine and the same version history as the shipped ones. Two things to know: it counts towards the booking’s document completion, and your buyer can see its title and status in Buyer Connect if your organisation has that portal switched on.
Why can I move a document to Under review but not to Signed?
Signed and Registered are publish-level: they need documents · publish, which most working seats do not hold. The button is visible with the reason attached rather than hidden, so you know who to ask. Everything short of those two is the edit permission.
Related pages.
- Upload a documentThe steps, the file types the server actually accepts, and what to do when it refuses one.
- Sharing with a buyerThere is no share link. What there is instead, and the two conditions on it.
- Tracking an e-signatureThe six states, who gets recorded, and what completing one moves.
- Documents, in fullThe product page: the chain, the desks, the RERA advance gate and what is not built.
Something on this page not matching what you see in the product? Write to support@saudaflow.in — the desk is open 09:30–19:00 IST, every day.