Security at Docket Secure

Last updated: 13 October 2026

People use Docket Secure for contracts, agreements and forms that matter, so protecting them is built into every part of it. This page explains, in plain words, how documents, signing links and accounts are kept safe, and what we deliberately don’t collect.

Your documents

  • Encrypted in transit and at rest. Every connection uses HTTPS, and browsers are told to use nothing else. Stored documents, signatures and the database are encrypted at rest with AES-256.
  • Private by default. A document can be opened only by the person who sent it, the people it was sent to, and, for a team document, the team. On a team, documents can be made private so only the person who made them can see them, not even the team owner.
  • Never public. Documents and signed copies are not on public addresses. Signed copies are downloaded from your account, attached to the email everyone receives, or reached through a signed link that expires after 30 days.
  • Checked on upload. Every upload is opened and checked to be a real PDF before it is accepted.
  • Long and unguessable. Each person gets their own link, made from a long random code. We store only a one-way fingerprint of it, so not even our database holds the links themselves.
  • Access codes. On paid plans you can give a signer a code to enter before the document opens. You tell them it by phone or text, so a forwarded email isn’t enough. After 5 wrong tries the link pauses for 15 minutes.
  • Confidential documents. On paid plans, mark a document as confidential and each signer gets the link and a code in two separate emails, with no title or message in either.
  • Links that end. Changing a signer’s email address, or making them a fresh link, stops the old one working. Sign-in-person QR codes last 20 minutes.
  • Hidden from search engines. Signing pages tell search engines not to index them, and they never send the address on to other websites.

Proof a document hasn’t changed

  • Fingerprints. When everyone has signed, the signed PDF gets a SHA-256 fingerprint, a short code that changes completely if even one character of the file changes. The original upload has one too.
  • Activity trail. The last page of every signed PDF records who was asked, who opened it, who signed and when, in UK time, and how each person signed.
  • Anyone can check. The Check a signed document page works out a file’s fingerprint in your browser (the file never leaves your device) and tells you whether it matches a document signed with Docket Secure.
  • Evidence pack. For any finished document you can download one file with the signed PDF, the original, both fingerprints and a plain-English summary of how it was signed.

Your account

  • Passwords. Passwords are never stored. We keep only a slow, salted one-way hash (PBKDF2-SHA256), unique to each account. Passwords found in known data breaches are refused; to check, only the first 5 characters of the password’s hash leave our service, never the password.
  • Two-step verification. Turn it on to need a 6-digit code as well as your password, from an authenticator app or by email. The app gives you 10 one-time recovery codes in case you lose your phone.
  • Recovery email. Add a second address and a password reset needs a code from it too. If you lose access to your login email, getting the account back takes 72 hours, and your current address is told and can cancel it.
  • Sessions. Logins use secure cookies that scripts on the page can’t read. You can sign out every other device at any time, and changing your password or login email does it for you.
  • Checks before anything final. Changes to money and security, such as seats, billing, email addresses, passwords and two-step, ask for your password again. Deleting something asks you to type a word to confirm.
  • Limits on misuse. Logins, sign-ups, resets and codes are rate limited, and new sign-ups pass a check that they are a person, not a bot.

Teams

  • Only the team owner manages billing and seats. Admins can manage the team’s documents and invitations; members can see the team’s shared documents but change only their own.
  • Every team’s documents, contacts and settings are kept apart from every other account’s, and we test this by trying to reach them from outside the team.

What we don’t collect

  • No IP addresses or locations in activity trails, signed PDFs or our database.
  • No heatmaps, session recordings or advertising trackers.
  • Analytics only if you accept them in the cookie choices, and never on signing pages.

Payments

Plans are sold by Polar, our merchant of record, who takes the payment and handles tax. Card details go straight to them and never reach Docket Secure.

Keeping and deleting

  • Each document can be set to delete itself a chosen number of days after it is finished. You are warned a week before and sent a final copy with its fingerprint on the day.
  • You can download everything we hold about you from Account, and deleting your account removes your documents and files.
  • The full list of what we keep, and for how long, is in our Privacy Policy.

Who can see your data

Access to the live service and its data is limited to the person who runs Docket Secure, and the tools used to support accounts show account details, never the contents of documents. If a breach ever put people at risk, we would tell the Information Commissioner’s Office and everyone affected, as the law requires.

Reporting a security problem

If you think you have found a security problem, please email hello@docketsecure.com with what you found and how to see it. Please don’t access other people’s data or disrupt the service while looking. Our security.txt file has the same details.