Security at DokLocker

Passwords are encrypted

Every stored password, Wi-Fi key and one-time code secret is encrypted before it reaches the database.

• The encryption key is kept apart from the database, so a copy of the database alone can't be read.
• Passwords are only sent to your browser when someone with permission clicks to reveal one, and they hide again after 30 seconds.
• Old passwords are kept in an encrypted history, so a change never loses the previous value.
• SSL private keys from other tools are never imported.

Sign-in you can trust

• Two-factor sign-in with an authenticator app, plus backup codes. Admins can require it for everyone.
• Single sign-on with Google, Microsoft, Okta or any OIDC provider. Admins can require it, so passwords stop working for everyone except admins.
• Passwords must be at least 12 characters, are checked against common passwords, and none of your last five can be used again.
• Changing or resetting a password signs you out everywhere else.
• Accounts lock after repeated wrong passwords, and admins can sign people out after a set idle time.
• Trusted networks: limit sign-in to your office or VPN addresses.

Only the right people see each thing

• Roles for every user: read-only, contributor or editor, plus admin.
• Seeing passwords is a separate permission, off by default.
• Security groups and folders limit which clients and passwords each team can open.
• Temporary access that ends on its own, for contractors or after-hours cover.
• A personal vault for each user's own logins, which nobody else can see.
• An offboarding checklist that removes a leaving person's access in one step and lists the passwords they viewed, so you know what to change.
• Suspend or disable a user in one click; they're signed out right away.
• The client portal shows a client only their own documentation, read-only, and passwords only if you allow it.
• Share links expire, can need a passcode, and can be stopped at any time.

Everything is on the record

• An audit log of every change: who, what, when, and from where.
• Every password reveal, sign-in, failed sign-in, export and share is logged.
• Changes made by integrations, imports and the AI assistant are labelled as such.
• Tamper-evident: each event is chained to the one before it with a keyed hash, and admins can check the whole log for changed or missing events at any time.
• Kept for the life of your workspace, with nothing deleted automatically. Download it, or stream every event to your SIEM with signed webhooks.

Your data stays yours

• Export everything to Excel or CSV whenever you like, in a format DokLocker can import again.
• If a trial or plan ends, nothing is deleted. Your workspace stays readable so you can look things up and export.
• DokBot only works with your data when you ask it to, never reads passwords back, and can only see what the person asking can see. You pick the AI provider, including a local model, or turn it off.
• Delete your account or your whole workspace yourself, any time, from your settings.
• Would rather keep it all in-house? DokLocker also runs on your own server.

Built with care

• Encrypted connections (HTTPS with HSTS) for every page. Self-hosted installs connect through Cloudflare Tunnel or Tailscale, with no open ports.
• The app runs as an unprivileged user in its container, and photos and files are only ever served to people allowed to see them.
• Protection against common web attacks: cross-site request forgery, clickjacking and content sniffing.
• Every code change goes through more than 600 automated tests before a new version is built.
• Two in-depth security code reviews of the whole app in November 2026: all 36 confirmed issues are fixed, each with a test that keeps it fixed. A full review now runs every month.
• Every release is digitally signed, lists every package inside it (SBOM), and is scanned for known vulnerabilities. Self-hosted customers can verify the signature.

Secrets that look after themselves

• BitLocker recovery keys are collected and stored encrypted against the right computer.
• Local admin passwords are rotated on schedule, with every old value kept in history.
• Each client has its own agent key, so one client's scripts can never write to another client.
• Integration keys are encrypted like passwords and never shown again after you save them.

HIPAA

Looking after medical or dental practices? DokLocker is designed to support your HIPAA program with the Security Rule's technical safeguards. One switch, HIPAA and PCI DSS safeguards, holds your sign-in rules to the minimums, and a built-in checklist shows what's in place.

PCI DSS

DokLocker isn't meant to hold card data, so we help you keep it out, and support the PCI DSS v4.0.1 requirements for the systems you document.