🏗️🔐 Form Ki Q launches AWS-native document platform with compliance-first architecture

Form Ki Q launched a document platform on AWS where compliance is architecture, not a checkbox. S3 + DynamoDB decouple storage from metadata, Bedrock handles PII/PHI classification, and Document Events fire real-time audit streams. All in a space ruled by Google Drive and Box. 🏗️🔐 Would you trust a startup with no track record to handle your most sensitive compliance documents?

A startup launched a document management system that treats compliance like a feature, not an afterthought.

On September 13, 2026, a new company called Form Ki Q went live with a document management platform built from scratch on AWS. The pitch is straightforward enough: separate the actual file storage (S3 with versioning) from the metadata layer (DynamoDB), couple the whole thing with encryption, and call it a day. But the startup's real move is how granularly it treats compliance, routing, and classification as core architecture rather than bolt-on checkboxes.

What it actually does

The platform stores documents in S3 with versioning enabled, which means every edit creates a recoverable snapshot—handy for anyone who's ever overwritten a critical file at 2 AM. Meanwhile, the metadata (who touched what, when, and under which retention schedule) lives in DynamoDB, keeping the two concerns decoupled for independent optimization and rich querying across large document collections.

Ingestion happens through several pathways: a CLI, a Secure File Transfer Gateway, and real-time inbound webhooks. Translation: you can shove documents at the system from code deployments, legacy file transfers, or HTTP callbacks. Amazon Cognito handles biometric ID verification—so yes, someone can verify their face to unlock document access, which sounds futuristic until you realize it's just combining two existing AWS services.

Amazon Bedrock powers rule-based routing and classification, meaning documents get tagged and directed by an LLM rather than a hardcoded if-else tree. Sensitivity detection, metadata extraction, and classification schemes all run through that same AI layer—including built-in handling for PII and PHI, a move that signals the startup is gunning for healthcare and legal verticals right out of the gate.

Wait, there's more alphabet soup

The security lineup reads like a cloud architect's wish list. Encryption touches data at rest and in transit. KMS handles key management. For the truly paranoid, Cloud HSM provides hardware-based key storage meeting FIPS 140-2. ClamAV scans uploads for malware. ABAC (attribute-based access control) determines who sees what, based on document attributes rather than rigid roles. Composite keys in DynamoDB enable multi-tenant isolation.

OCR via Textract extracts text from scanned PDFs. PDF generation happens server-side. Deeplinks point directly to specific document versions. Retention schedules, legal holds, and compliance tagging are baked into the metadata schema. The versioning history creates a persistent audit trail—every edit, every access, every classification event is recoverable, which aligns neatly with most regulatory retention schedules. SNS and EventBridge provide event notifications. The whole thing connects through a client-side interface that works on mobile and web.

That document events thing

On launch day, Form Ki Q also rolled out Document Events—real-time notifications for every lifecycle change: creation, updates, deletions, and classification modifications. These events fire via Amazon S3 event notifications and Amazon SNS, running inside the customer's own AWS account. Each event carries action type, metadata attributes, timestamp, document identifier, and site/user context. This creates a real-time audit stream that complements Form Ki Q's built-in trail, useful for compliance programs that require an independently maintained, immutable record of document activity.

Why this matters right now

The document management space is crowded—Google Drive, Dropbox, Box, SharePoint, and a dozen open-source alternatives already exist. What Form Ki Q is betting on is that regulated industries (healthcare, legal, finance, government) will pay a premium for a system where compliance isn't an add-on but the starting point.

The platform handles PII and PHI classification out of the box. The versioning history creates an audit trail that satisfies most retention schedules. The separation of storage from metadata means you can query documents by compliance status without scanning every file. The Document Events feature means you can wire that compliance data straight into external audit tools.

The catch

Form Ki Q is a startup with no track record and, as of launch, no announced customers. It carries a heavy dependency on AWS infrastructure—if AWS changes pricing, throttling limits, or service availability, the platform's cost structure and reliability shift with it. The use of Bedrock for classification also means that document routing and sensitivity detection depend on an LLM that can hallucinate or misclassify. Beyond the core storage and events architecture, announcements about forms and form-builder capabilities remain in preview, limited to Advanced and Enterprise editions.

What's next

The company has signaled plans for advanced AI-driven prediction features and multilingual text insight capabilities in future tiers. That suggests they're chasing enterprises with global document workflows—think international law firms, multinational compliance teams, or cross-border healthcare data management.

For now, Form Ki Q is a well-architected launch in a competitive space. Whether it gains traction depends on whether regulated organizations trust a new, AWS-dependent vendor with their most sensitive documents. The architecture says yes. The market will decide.