Plain answers about what protects your vault, who can get in, and what happens when someone tries.
No. Only you can sign in to your vault, and signing in from a new device or location takes a one-time code sent to your email. Your documents are released only to the recipients you name, and only after a verified event and a waiting period.
They would get scrambled data. Every document is encrypted before it is stored, and the stored files are kept away from the public part of the website, where no web address can reach them.
Your documents are protected while they travel to us and while they are stored with us.
Each document is encrypted with AES-256 as it is saved, and every document gets its own unique key. If a stored file were ever altered, DokuDocs would detect it and refuse to open it.
Every page and every file travels over an encrypted HTTPS connection. Your browser is told never to connect to DokuDocs any other way.
Each account has its own numbered vault. Before any document is shown or downloaded, DokuDocs checks that it belongs to the person asking, every single time.
Strong technology, and very few hands on it.
Our servers sit behind a dedicated Juniper SRX enterprise firewall, the same class of equipment businesses use to guard their networks. It filters traffic before it ever reaches the systems that hold your documents.
Only the most senior people at DokuDocs, such as founder Mark Horton, can access customer data. Mark's earlier career in software development included work for the National Security Agency, RCA and General Dynamics Corporation, where he held both U.S. Secret and U.S. Top Secret clearances. Staff sign-in has its own 2-step verification, and staff actions are recorded.
Even if someone learned your password, they would still need access to your email to get in.
When you sign in from a new device or a new location, we email you a one-time code. Codes expire after a few minutes and stop working after repeated wrong tries. You can choose to trust a device you use often, so you aren't asked every time.
We email you when your account is signed in to from a new location, when your password is reset, when your account is locked, and when someone keeps entering wrong codes. If it wasn't you, you will know right away.
Repeated wrong passwords or codes lock the account for a while, so no one can keep guessing. Resetting your password removes the trust from your other devices.
Sign-ins, document downloads and access requests are recorded with the date and time, so there is always a clear history of what happened on an account.
Your documents are meant to reach your loved ones, and no one else.
Only the people you designate can ever receive your documents. Anyone else who asks about a vault is told nothing about it.
We check government death records on a regular schedule. If a record appears, you are asked to confirm you are alive before anything happens, and a mistaken record is remembered so it can't trigger a release again.
Even after a verified event, there is a waiting period before anything is released, giving time to stop a release that shouldn't happen.
Our promise on this page: everything described here is in place and working today. We would rather tell you plainly what we do than display badges we haven't earned. As our protections grow, this page will be updated.
DokuDocs