A security checklist for self-hosted team chat
Fourteen checks before you put real company conversations on a server you run yourself.
The short answer
Self-hosting gives you control of your data, and also responsibility for protecting it. Most problems come from a short list of basics: patching, HTTPS, strong sign-in, backups and who has admin rights. This checklist covers them in the order we would do them.
It is general guidance, not a guarantee or a compliance certificate. For regulated data, ask a security professional to review your setup.
Before launch
Put it behind HTTPS
Use a valid certificate and redirect plain HTTP.
Turn on two-step sign-in
Require it for admins at least. Dock supports authenticator-app codes (TOTP).
Limit admins
Give admin rights to as few people as possible and review the list.
Set a retention policy
Decide how long messages and files are kept.
Running it
Patch on a schedule
Pick a regular day to update the app, the runtime and the operating system.
Back up and test restores
A backup you have not restored is a guess. Store copies off the server and encrypt them.
Watch the audit log
Review admin and sign-in events for anything odd.
Close what you do not use
Disable features, bots and tokens nobody needs.
Checks people forget
Tokens and API keys
Rotate them and revoke old ones. Treat an AI agent token like a password.
Offboarding
Remove leavers from every workspace on their last day.
Exports
Know how to export your data, and who is allowed to.
Guest access
Invite guests only to what they need.
What Dock gives you, and what is yours to do
Dock includes an admin console with two-step sign-in, an audit log, retention settings, roles and a data export that leaves secrets out. It runs as one Node process with one SQLite file, which keeps backups simple.
Dock does not have SAML single sign-on or directory sync today. HTTPS, updates, backups and server access remain your job. See the admin and security page.
Questions
Is self-hosted chat more secure than hosted?
Not automatically. You control the data, but you also own patching, backups and access.
Do I need a firewall?
Expose only the ports you need and keep the database file off public paths.
How often should I back up?
At least daily for active teams, and test a restore each quarter.