Security and where your data lives
DockyDoc holds passports, contracts and licences, so this page says plainly what protects them, where they are, and who else touches them. It is written for the person who has to answer a customer's security questionnaire.
How files and data are protected
- In transit: every connection uses TLS. There is no unencrypted path to the app, the API or storage.
- At rest: files are stored in a private bucket with server-side encryption; the database is encrypted at rest by the provider.
- Downloads: files are never public. Every download is a short-lived signed link tied to a signed-in user or a share link you created.
- Sign-in: handled by Clerk with verified email and optional two-factor authentication; Team workspaces can require two-factor for everyone. DockyDoc never stores your password.
- Access: workspace roles Owner, Admin, Editor and Viewer; API keys are hashed, scoped to read or write, and revocable; share links can carry a password and an expiry and can be revoked.
- Audit: uploads, downloads, shares, deletions and member changes are logged with who and when; Business and Team can export the log.
- Backups: file versioning with a copy in a second region, database point-in-time restore, and a monthly restore drill.
- Deletion: deleted documents sit in a bin (30 to 90 days by plan, or a retention policy you set) and are then shredded from storage. You can delete your whole account yourself from Settings.
Who processes your data
DockyDoc is run by Excelleta Tech Private Limited, New Delhi, India. These providers process data on its behalf under written data processing terms. Customers on Business and Team are covered by our own data processing agreement, and this table is the sub-processor list it refers to; changes are announced by email 30 days ahead.
| Provider | What it does | Where |
|---|---|---|
| Amazon Web Services (S3) | Encrypted file storage | Mumbai, India, with a copy in Singapore |
| Neon | Database (document details, dates, accounts) | Singapore |
| Render | Application servers | Singapore |
| Vercel | Web application delivery | Global edge network; application code runs in Singapore |
| Clerk | Sign-in and two-factor authentication | United States |
| Anthropic | AI reading of documents and the assistant | United States; documents are not used to train models |
| Microsoft Azure Document Intelligence | OCR of scans and photos | Microsoft Azure; text only, not stored after reading |
| OpenAI and Mistral | OCR fallbacks when Azure cannot read a file | United States and European Union |
| Resend | Email reminders and notifications | United States |
| Razorpay | Payments from India | India |
| Paddle | Payments from outside India, tax collection | United Kingdom |
Your rights
Wherever you are, you can see, export and delete everything DockyDoc holds about you from Settings, without asking. For people in the European Union and the United Kingdom this is under GDPR and UK GDPR; for people in India under the Digital Personal Data Protection Act 2023. Questions and requests go to privacy@dockydoc.app and are answered within 30 days. If DockyDoc ever suffers a breach affecting your data, you are told within 72 hours of it being confirmed.
Reporting a security problem
Email nj@excelleta.techwith “security” in the subject. Reports are acknowledged within two working days and fixed before they are discussed publicly.