Limitation of Liability

You choose the access delay period (typically 4–5 business days), whether a death certificate is required, and which Recipients can access which categories of documents. Our status-verification system and access-delay timers are designed to follow exactly the rules you set.

What we control: we will not release documents outside the rules you configured, absent a bug or security failure.

What we can't fully control: like any software, our status-verification system, timers, or third-party data sources could theoretically malfunction or be manipulated. If an early release occurs due to our error, we will investigate and take corrective action; however, as described in our Terms of Service (Section 10), our financial liability for any such error is limited, and we are not liable for indirect or consequential damages (such as a Recipient acting on a document before you intended).

What reduces this risk: selecting a longer access delay, requiring a death certificate for sensitive documents, and reviewing your DCM and access settings periodically.

We use encrypted transmission (HTTPS/TLS), hashed passwords, token-based Recipient access, and access logging to protect your account and documents. We monitor for suspicious activity and apply security updates on an ongoing basis.

What we control: implementing and maintaining reasonable, industry-standard security practices, and responding promptly if we detect a breach, including notifying affected Customers as required by law.

What we can't fully control: no system connected to the internet can be guaranteed unbreakable. Sophisticated attacks, previously unknown software vulnerabilities, or a Customer's own compromised email or password (for example, through phishing) can lead to unauthorized access despite our safeguards. As described in our Terms of Service (Section 8), we are not liable for losses resulting from unauthorized access except where caused by our gross negligence or willful misconduct, or where such liability cannot legally be excluded.

What reduces this risk: using a strong, unique password for your DokuDocs account, enabling any additional security features we offer, and never sharing your login credentials.

When a status change is detected, we attempt to notify each Recipient using the contact information you provided, via email and (if you've enabled it) postal mail.

What we control: sending notifications promptly to the contact information on file, using reliable third-party email and mail delivery providers.

What we can't fully control: we cannot guarantee that a Recipient's email address or mailing address is current, that their email provider won't filter our message as spam, that they will check their inbox or mail, or that they remain reachable at all. As described in our Terms of Service (Section 7), we are not liable for delayed, failed, or non-delivered notifications resulting from outdated contact information or third-party delivery failures, except where such liability cannot be excluded under applicable law.

What reduces this risk: keeping Recipient contact information current, designating more than one Recipient where appropriate, and periodically confirming with your Recipients that they understand their role.