Enterprise-Grade Security That Keeps Your Data and Brand Safe

This page describes the technical and organisational security measures Cyberdune Technologies Private Limited uses to protect the Docket service and the data in it. It is referred to by the privacy policy and forms part of the data processing addendum. It describes the service as it is built today.

Docket runs on established cloud infrastructure providers, with a managed database, authentication and file storage. Data is stored in hosting regionTBC (to be confirmed). If you have a data residency requirement, tell us before you commit and we will confirm what is possible.

The categories of provider that process data for us, and what each receives, are on the sub-processor list.

The Docket website and app are served over HTTPS, and Docket’s servers connect to every provider and to Google over HTTPS. When you connect a WordPress site, Docket uses HTTPS unless you enter an address that starts with http://. Always use an HTTPS address for your WordPress site, because over plain HTTP the application password travels unencrypted.

WordPress application passwords and Google tokens are encrypted before they are stored, using AES-256 authenticated encryption. Encryption keys are kept separately from the data they protect.

Stored credentials can never be read back by the browser, by any signed-in session, including your own. They are decrypted only on Docket’s servers, at the moment Docket publishes, checks a connection or reads Google data.

Passwords for Docket accounts are stored only as salted hashes by our authentication provider. Docket never sees them in readable form.

Docket trains no AI model, and does not use your content to train one. Content is sent to our AI model provider only to produce output for you, under terms stating that the data we send is not used to train its models.

Drafts are grounded in your own website, brand settings and Vault, and every post is checked against your brand safety rules before it reaches your site.

Access to customer data is enforced at the data layer, not by the interface remembering to filter: a person can reach a website only if they own it or belong to its workspace.

Separation between customers is tested automatically whenever the data model changes, and a change that would weaken it is not released.

Within a workspace, everyone on the team can see every website. To keep a client’s website private from part of your team, use a separate workspace.

• Sign-in is by email and password, or with Google, through a managed authentication service.
• A workspace has two roles, Owner and Member, and at most four people. A workspace can require that only an Owner may publish.
• Privileged keys and service credentials are held only on Docket’s servers, used only for specific server tasks, and never sent to the browser.
• A small number of authorised Docket administrators have read access to customer data for support and operations.

Google. Docket requests only these permissions: openid, userinfo.email, webmasters.readonly and analytics.readonly. It can read Search Console and Google Analytics reports and cannot change anything in your Google account. Disconnecting Google in Docket asks Google to revoke the token and deletes the stored connection. You can also revoke access from your Google account at any time.

WordPress. Docket uses an application password, which you create in WordPress for Docket alone and can revoke there without changing your main password. It publishes to posts only. Give it an account with only the permissions you want it to have.

• Publishing follows your settings: a post goes live when it is published or at its scheduled time, and the approval role can limit publishing to workspace owners.
• Safeguards stop a double click, or a click racing a scheduled publish, from creating two posts.
• Brand safety rules you set (banned terms, banned claims, required disclaimers, competitor rules and a mandatory fact check) block publishing when they fail, and they fail closed: a rule that cannot be checked blocks the publish.

Docket records activity for each website, with the time and the person who acted: AI operations (such as topic planning, article generation and refreshes), publishing, scheduled posts that were blocked, version restores, changes to brand safety rules and website settings, and connection changes. Each publish records the post address and ID, the featured image, the schema types, the SEO fields written, and the categories and tags. Everyone on the team can see the log in the product.

• The free preview is rate limited.
• Contact forms are protected against bots, are rate limited, and store only a shortened IP address.
• AI use per website is capped daily, to limit the impact of a fault or misuse.
• Links added to the Vault are fetched with a guard against requests to private networks.

If we become aware of a personal data breach affecting customer data, we will notify affected customers as set out in the data processing addendum, and regulators and individuals as the law requires.

Our team completes security questionnaires for procurement and IT reviews on request, and answers each requirement accurately. Formal certifications such as SOC 2 and ISO 27001, and single sign-on (SSO), are not yet in place.

If your review has specific requirements, such as data residency, tell us early so we can confirm what is possible before you commit.

If you find a security issue, email support@docket.ltd with a description, the steps to reproduce it and its likely impact. We will acknowledge your report and keep you updated.

Please give us reasonable time to fix the issue before you disclose it, do not access or change other people’s data, and avoid degrading the service. We will not take legal action against anyone who reports a genuine issue in good faith in line with this section.

Book a demo to see Docket on your own website and request a completed security questionnaire for your review. To see what ChatGPT says about your brand first, run the free AI visibility check, which needs no account.

Related: the privacy policy, the sub-processor list and how WordPress publishing works.