arrow_back Back to home

Last updated 2 November 2026

Security Architecture

How we protect your documents, data, and deal integrity. Built for enterprises that need to justify their tooling choices to IT and legal teams.

Infrastructure

Application servers, the database, encrypted file storage, and backups run on Hetzner infrastructure in Germany. Backups are encrypted and kept separate from the primary system.

Encryption

In transit

All communications use TLS 1.2+ encryption. API endpoints, file uploads, and inter-service communication are encrypted end-to-end. HSTS headers enforce HTTPS-only access.

At rest — database

The database runs on encrypted disks in the EEA and is only reachable from our application servers.

At rest — documents

Each document is encrypted with ChaCha20-Poly1305 and its own key before it is written to storage, so a leaked storage bucket reveals nothing readable. Staff do not access document content unless you ask us to for support or the law requires it.

Authentication & Identity

Doki Dok does not store passwords. You sign in with:

  • Magic links — a single-use sign-in link sent to your email, valid for 10 minutes
  • Google or Microsoft — single sign-on with your existing work account

Authentication runs on our own servers (self-hosted Better Auth); sessions expire after 30 days.

Coming soon: signing with national eID through Smart-ID, Mobile-ID, and eParaksts. These produce qualified electronic signatures, which under the eIDAS Regulation have the same legal effect as a handwritten signature across the EU/EEA.

Document Security

Documents are the core of what Doki Dok protects. Our approach:

1

Individual encryption

Each file is encrypted with a unique key. Bulk compromise is not possible through a single key exposure.

2

No training, no selling

Documents are never used to train AI models, sold to third parties, or accessed by Doki Dok personnel. They exist solely for your use within the Service.

3

Access control

Deal room access is permission-based. Document access is logged and auditable. File sharing generates controlled access links with configurable expiry.

4

Secure deletion

When documents are deleted, they are permanently removed from primary storage and purged from backups within the backup rotation cycle.

Audit Logging

Every action within a deal room is recorded in an immutable audit log. This includes:

  • Document uploads, downloads, and version changes
  • Signature events and identity verification results
  • Permission changes and access grants
  • Comment and annotation activity
  • Room creation, modification, and closure

Audit logs are append-only and cannot be modified or deleted by any user, including administrators. They are retained for the legally required period to support deal integrity and regulatory compliance.

Compliance Posture

Transparency note: We do not currently hold SOC 2 or ISO 27001 certifications. However, our infrastructure, processes, and controls are designed to align with these frameworks, and we are actively working toward formal certification.

Our current compliance posture includes:

GDPR

Norwegian/EEA company. Data processing terms for every customer and agreements with all sub-processors — see GDPR & Data Processing. Documents are stored and processed within the EEA.

eIDAS

Qualified electronic signatures through Smart-ID, Mobile-ID, and eParaksts are in integration testing.

SOC 2 (alignment)

Controls aligned with SOC 2 Type II trust principles: security, availability, processing integrity, confidentiality, and privacy. Formal certification in progress.

ISO 27001 (alignment)

Information security management practices aligned with ISO 27001 requirements. Formal certification planned.

Third-Party Security

We keep the number of providers small and have a data processing agreement with each of them. The current list is on GDPR & Data Processing.

Incident Response

In the event of a security incident, our response process includes:

  • Immediate containment and investigation
  • Notification to affected customers without undue delay, and within 48 hours
  • Notification to the Norwegian Data Protection Authority (Datatilsynet) within 72 hours where legally required
  • Post-incident review and remediation
  • Transparent communication throughout the process

Questions?

If you have questions about our security practices or need information for a vendor assessment, contact us:

Agdir Drift AS — Security

Waglesgårdveien 38, 4844 Arendal, Norway

Org. nr. 921 893 639

Email: [email protected]
Phone: +47 370 23 500