Security and privacy
Private by default
Section titled “Private by default”Every new doc is private to its workspace. Opening a private doc always checks access first. Someone without access gets the same “not found” as for a doc that doesn’t exist, so a link never reveals whether something is there.
Public links show only the doc
Section titled “Public links show only the doc”A public page shows the doc as it is now. It never shows History, who wrote or changed it, or the workspace’s name.
HTML docs run sealed off
Section titled “HTML docs run sealed off”An HTML doc’s scripts run in a sandboxed frame with an origin of its own. They can’t read Dockito, your sign-in, your cookies or other docs.
Sign-in
Section titled “Sign-in”You sign in with GitHub or Google. Dockito doesn’t store passwords. Account → Sessions and devices lists every browser, CLI login and AI client signed in to your account, and signs any of them out.
Tokens are stored only as hashes. Removing someone from a workspace stops their access there at once, from every device and token.
Your AI, not ours
Section titled “Your AI, not ours”Dockito never sends your docs to an AI. Your own AI client reads and writes them through the CLI or the MCP server, with the access you gave it.
Storage
Section titled “Storage”Files are stored on Cloudflare R2 and everything else in a Postgres database. Both encrypt data at rest.
Reporting a problem
Section titled “Reporting a problem”Email hello@dockito.ai about anything security related.