Encrypted storage
Customer files are stored in Cloudflare R2. R2 encrypts objects at rest by default with AES-256, and the app is built around S3-compatible credentials plus presigned URLs instead of broad browser credentials.
A private Vault for client document intake.
DokuTrak collects sensitive client documents through scoped upload links, encrypted object storage, server-side authorization, and an append-only audit trail. This page lists controls that exist in the product or production architecture today, and calls out what is still an operator checklist item.
- AES-256 at rest in R2
- HTTPS via Caddy
- Append-only audit log
- Clerk auth
- Redis-backed rate limits
Last reviewed July 10, 2026
- App host
- Hostinger VPS, Paris
- Caddy fronts separate Docker services for the marketing site, web app, and API.
- Database
- Local Postgres container
- Postgres is attached to the internal Docker network, not the public reverse-proxy network.
- File storage
- Cloudflare R2
- The application issues scoped presigned URLs for document upload and access.
TLS in front of the app
Production traffic reaches DokuTrak through Caddy, which terminates HTTPS for dokutrak.com and app.dokutrak.com and supports TLS 1.3.
Append-only audit log
The audit_logs table records security-sensitive activity with actor, organization, action, entity, timestamp, IP/user-agent context, sanitized metadata, and payload hashes. A Postgres trigger blocks UPDATE and DELETE on audit rows.
Secure upload link intake
External recipients upload through scoped secure upload links instead of creating accounts. Links expire, are validated server-side, are rate-limited, and are invalidated when the underlying request/link record is removed.
Account authentication
Team authentication is handled by Clerk. The API verifies Clerk JWTs server-side, resolves organization context before protected actions, and can enforce Clerk second-factor verification for paid workspaces.
Isolated runtime services
The production API, web app, marketing site, Postgres, and Redis run as separate Docker services. Postgres and Redis are on an internal Docker network and are not exposed through the public reverse proxy.
Services used to operate DokuTrak
These vendors support authentication, storage, billing, transactional messaging, monitoring, and analytics.
| Provider | Purpose |
|---|---|
| Clerk | Authentication, sessions, user profile, MFA/TOTP flows, and auth emails. |
| Stripe | Billing, checkout, subscriptions, invoices, and payment webhooks. |
| Resend | Transactional business emails such as document requests and reminders. |
| Cloudflare R2 | S3-compatible object storage for uploaded customer documents. |
| Sentry | Application error monitoring and production debugging context. |
| PostHog EU | Product analytics for usage and funnel events. |
| Cloudflare Workers AI | Inference for AI First-Pass Review when enabled by a workspace, and document type/date suggestions in the public AI Document Renamer after the visitor gives explicit consent. The renamer processes one uploaded file in memory for the request; DokuTrak does not save it to customer document storage or to disk. It also turns a visitor’s recurring sent emails into reusable templates in the public Inbox Follow-up Audit, when the visitor ticks that option before connecting their mailbox; those emails are processed in memory for the request and are not kept. Same infrastructure provider as document storage. Cloudflare states in its Workers AI terms (last updated April 21, 2026) that customer inference inputs are not used to train its models. |
AI First-Pass Review moved to Cloudflare Workers AI on July 9, 2026. Documents are stored and reviewed on the same infrastructure provider; as of July 10, 2026, DokuTrak does not send first-pass review content to standalone AI API vendors.
Report a security issue
Send reproduction steps, affected URLs, impact, and your preferred contact address. Do not send customer files, secrets, or destructive proof-of-concept payloads.
Security questions
These answers are limited to controls that are implemented in the codebase or known production topology.
What does the Vault metaphor mean?
DokuTrak uses Vault as a product metaphor for a private document collection space: professionals send a scoped upload link, clients upload requested files, and access is mediated by application permissions. It is not a claim that DokuTrak uses a hardware security module or a separate secrets-vault product for customer files.
How are uploaded files protected?
Files are encrypted at rest by Cloudflare R2 with AES-256 (provider default). The app issues scoped, expiring presigned URLs for upload and access. The R2 bucket is private (verified June 24, 2026); lifecycle policies remain an operational checklist item.
How are client upload links protected?
Upload links are random tokens scoped to a document request. The API validates token format and expiry, applies route-level rate limits, and rejects expired or removed links.
Do you use multi-factor authentication?
DokuTrak uses Clerk for account authentication. The codebase includes paid-plan MFA enforcement based on Clerk second-factor verification, with the exact TOTP/session settings configured in the Clerk dashboard.
Who are DokuTrak subprocessors?
The current subprocessors are Clerk for auth, Stripe for billing, Resend for transactional email, Cloudflare for file storage (R2), AI First-Pass Review and, after explicit visitor consent, the public AI Document Renamer (Workers AI), Sentry for error monitoring, and PostHog EU for analytics.
When does DokuTrak send a document to AI?
AI First-Pass Review sends document content to Cloudflare Workers AI only when a workspace admin enables it; it is assistive, audit-logged, and a human reviewer makes every final decision. The public AI Document Renamer sends a file to Cloudflare Workers AI only after the visitor gives explicit consent, to suggest its document type and dates. DokuTrak processes that file in memory for the request and does not save it to customer document storage or to disk. The public Inbox Follow-up Audit sends the subjects and bodies of a visitor’s sent emails to Cloudflare Workers AI only when the visitor ticks the optional templates box before connecting; those emails are processed for that request and are not kept, and DokuTrak removes names, addresses, phone numbers and amounts from every template it keeps. DokuTrak sends document content to no other AI vendor. Cloudflare states in its Workers AI terms (last updated April 21, 2026) that customer inference inputs are not used to train its models.
How do I report a security issue?
Email security@dokutrak.com with the affected URL or endpoint, reproduction steps, expected impact, and your preferred contact address. Do not send customer files, secrets, or destructive payloads.
Claims we do not make
- DokuTrak does not currently claim SOC 2, ISO 27001, HIPAA compliance, or BAA support.
- Cloudflare WAF, R2 lifecycle policies, Hostinger account MFA, and security@ email routing are operational dashboard tasks and are not claimed complete here until verified.
- A standalone upload-link revoke endpoint is not currently exposed; request deletion removes the linked upload-link record and invalidates that URL.
- AI First-Pass Review is assistive and never auto-approves documents; a human reviewer makes every final decision.
Need product details before a trial?
Review the workflow first, then choose whether the controls fit your firm.