What we do, what you control, and what we do not claim
Dock is self-hosted, so you control where data lives. Here is exactly what the software does and does not offer.
What exists today
Password hashing
Passwords are hashed with scrypt.
Two-step login
Require an authenticator app (TOTP) for members.
Lockout and password policy
Repeated failures lock the account for a while; admins set rules.
Audit log
Sign-ins and admin actions are recorded and exportable as CSV.
Workspace isolation
Members see only the workspaces and private groups they belong to.
Daily backups
The server writes database backups every day.
Signed Mac app
The Mac app is signed and notarized by Apple.
Your responsibilities
When you self-host, you secure the server: use HTTPS, keep the operating system and Node updated, limit access and keep backups. Dock does not do this for you. On Managed, we run the server; contact us for details.
What we do not claim
No certifications such as SOC 2 or ISO 27001. No independent security audit. No end-to-end encryption. No single sign-on (SSO). No guarantee of uptime for self-hosted installs. Windows and Linux builds are untested.
Questions
Is data encrypted?
Use HTTPS in front of the server. Encryption at rest depends on your disk setup. End-to-end encryption is not offered.
How do I report a problem?
Use the contact page and mark it security.
Do AI features send my data out?
Only if you turn on features that call an AI provider, and those are planned for the paid tier. The MCP server runs under a bot token you control.