Encrypted storage
Customer files are stored in Cloudflare R2. R2 encrypts objects at rest by default with AES-256, and the app is built around S3-compatible credentials plus presigned URLs instead of broad browser credentials.
Security
A private Vault for client document intake.
DokuTrak collects sensitive client documents through scoped upload links, encrypted object storage, server-side authorization, and an append-only audit trail. This page lists controls that exist in the product or production architecture today, and calls out what is still an operator checklist item.
AES-256 at rest in R2HTTPS via CaddyAppend-only audit logClerk authRedis-backed rate limits
TLS in front of the app
Production traffic reaches DokuTrak through Caddy, which terminates HTTPS for dokutrak.com and app.dokutrak.com and supports TLS 1.3.
Append-only audit log
The audit_logs table records security-sensitive activity with actor, organization, action, entity, timestamp, IP/user-agent context, sanitized metadata, and payload hashes. A Postgres trigger blocks UPDATE and DELETE on audit rows.
Secure upload link intake
External recipients upload through scoped secure upload links instead of creating accounts. Links expire, are validated server-side, are rate-limited, and are invalidated when the underlying request/link record is removed.
Account authentication
Team authentication is handled by Clerk. The API verifies Clerk JWTs server-side, resolves organization context before protected actions, and can enforce Clerk second-factor verification for paid workspaces.
Isolated runtime services
The production API, web app, marketing site, Postgres, and Redis run as separate Docker services. Postgres and Redis are on an internal Docker network and are not exposed through the public reverse proxy.
Subprocessors
Services used to operate DokuTrak
These vendors support authentication, storage, billing, transactional messaging, monitoring, and analytics.
| Provider | Purpose |
|---|---|
| Clerk | Authentication, sessions, user profile, MFA/TOTP flows, and auth emails. |
| Stripe | Billing, checkout, subscriptions, invoices, and payment webhooks. |
| Resend | Transactional business emails such as document requests and reminders. |
| Cloudflare R2 | S3-compatible object storage for uploaded customer documents. |
| Sentry | Application error monitoring and production debugging context. |
| PostHog EU | Product analytics for usage and funnel events. |
| Cloudflare Workers AI | Inference for AI First-Pass Review (document text extraction and review verdict) when a workspace enables the AI review toggle. Same infrastructure provider as document storage. Cloudflare states in its Workers AI terms (last updated April 21, 2026) that customer inference inputs are not used to train its models. |
Inactive transition providers
AI First-Pass Review moved to Cloudflare Workers AI on July 9, 2026. Documents are stored and reviewed on the same infrastructure provider; as of July 10, 2026, DokuTrak does not send first-pass review content to standalone AI API vendors.
| Mistral OCR | Used for the OCR stage of AI First-Pass Review before July 9, 2026. Production credentials removed; integration code retained temporarily during decommissioning and cannot process documents unless deliberately re-provisioned, in which case this page and the Privacy Policy would be updated first. |
|---|---|
| OpenRouter | Used for the verdict stage of AI First-Pass Review before July 9, 2026. Same status: credentials removed, code pending deletion at end of the transition window. |
Report a security issue
Send reproduction steps, affected URLs, impact, and your preferred contact address. Do not send customer files, secrets, or destructive proof-of-concept payloads.
Security questions
These answers are limited to controls that are implemented in the codebase or known production topology.
What does the Vault metaphor mean?
DokuTrak uses Vault as a product metaphor for a private document collection space: professionals send a scoped upload link, clients upload requested files, and access is mediated by application permissions. It is not a claim that DokuTrak uses a hardware security module or a separate secrets-vault product for customer files.
How are uploaded files protected?
Files are encrypted at rest by Cloudflare R2 with AES-256 (provider default). The app issues scoped, expiring presigned URLs for upload and access. The R2 bucket is private (verified June 24, 2026); lifecycle policies remain an operational checklist item.
How are client upload links protected?
Upload links are random tokens scoped to a document request. The API validates token format and expiry, applies route-level rate limits, and rejects expired or removed links.
Do you use multi-factor authentication?
DokuTrak uses Clerk for account authentication. The codebase includes paid-plan MFA enforcement based on Clerk second-factor verification, with the exact TOTP/session settings configured in the Clerk dashboard.
Who are DokuTrak subprocessors?
The current subprocessors are Clerk for auth, Stripe for billing, Resend for transactional email, Cloudflare for file storage (R2) and AI First-Pass Review inference (Workers AI), Sentry for error monitoring, and PostHog EU for analytics. Mistral OCR and OpenRouter are inactive transition providers: they served AI First-Pass Review before July 9, 2026, their production credentials have been removed, and the remaining integration code is being decommissioned.
Does AI review share documents with AI companies?
Documents are processed by Cloudflare Workers AI — the same infrastructure provider that already stores them in R2 — and by no other AI vendor. As of July 10, 2026, DokuTrak sends no document content to Mistral, OpenRouter, OpenAI, or Anthropic. If that ever changes, this page and the Privacy Policy will be updated before any new vendor processes a document. Cloudflare states in its Workers AI terms (last updated April 21, 2026) that customer inference inputs are not used to train its models. The feature is off by default, enabled per workspace by an admin, audit-logged, and a human reviewer makes every final decision.
How do I report a security issue?
Email [email protected] with the affected URL or endpoint, reproduction steps, expected impact, and your preferred contact address. Do not send customer files, secrets, or destructive payloads.
Current limits
Claims we do not make
- DokuTrak does not currently claim SOC 2, ISO 27001, HIPAA compliance, or BAA support.
- Cloudflare WAF, R2 lifecycle policies, Hostinger account MFA, and security@ email routing are operational dashboard tasks and are not claimed complete here until verified.
- A standalone upload-link revoke endpoint is not currently exposed; request deletion removes the linked upload-link record and invalidates that URL.
- AI First-Pass Review is assistive and never auto-approves documents; a human reviewer makes every final decision.
Need product details before a trial?
Review the workflow first, then choose whether the controls fit your firm.