Security
Controlled access to decision-bounded technical records.
This page summarizes the current product controls. Contracted security, data-processing, retention, permitted-use, and incident terms govern where applicable. Doku does not claim certifications that are not expressly documented.
Access and credentials
Partner API credentials are hashed at rest, scoped, partner-rate-limited, separated between test and live modes, and designed for rotation and revocation. Customer status and intake links are signed and expiring. Exchange routes replace URL credentials with short-lived Secure, HttpOnly, SameSite cookies and redirect to clean URLs.
Private data and evidence links
Evidence and data-room URLs are treated as secrets. The application does not automatically fetch them and excludes them from advertising analytics, routine emails, and ordinary application summaries. Restricted intake, status, upload, and deliverable routes do not load third-party advertising analytics.
Persistence and deliverables
Production review records require configured private persistence. Private-storage features fail closed when storage is unavailable and do not fall back to public object access. Authorized deliverables include version, issue date, superseded state, file hash, authorized audience, and download expiration.
Webhooks and audit history
Webhooks use a timestamped HMAC-SHA256 signature and receivers should reject stale requests outside the documented replay window. Review workflows use append-only events with monotonic sequence numbers. Partner audit responses omit confidential event payloads.
Retention and deletion
Doku-hosted artifacts use an explicit retention period only when hosted artifacts exist. Lender-approved data-room links do not create a Doku-hosted retention selection. Scheduled deletion is limited to identified private quarantine paths and records its outcome.
Reporting a security concern
Email jorg@dokuassurance.com with “Security incident” in the subject. Do not include secrets or confidential evidence in ordinary email.