Security
Locked down, from the first link to the last download.
Passports, contracts, bank statements and health forms deserve better than an attachment in an inbox. In Docsroom every link is private and runs out, your team can sign in with a second key, and every download goes on the record.
Settings
Rennick & Vale · as an admin sees them
Two-factor sign-in
6 of 6 staff have it on
Client links
Expire after 90 days · withdraw any time
Where you are signed in
This Mac and an iPhone · sign out the others
Backups
Last night at 02:00 · Back up now
The database keeps only a SHA-256 fingerprint of each one, so a copy of it opens nothing.
Never kept as text. Eight wrong passwords lock the account for fifteen minutes.
A code from an authenticator app, with eight single-use recovery codes.
Who downloaded, when, and how many files, for every client and pack.
Clients use links, never passwords
Everyone you add to a client has their own private link. It shows only the requests assigned to that person, so a director and an office manager on the same client each see their own list. Creating a new link invalidates the old one, and Withdraw link revokes access immediately.
There is nothing for a client to remember or reuse across sites, and no password that could be phished. If they lose the link, the client sign-in page issues a fresh one to the email address on their record and says the same thing whether or not the address is known.
Every link
Everything expires
Nothing Docsroom hands out lasts for ever, and most of it can be taken back before it lapses.
Links Docsroom hands out
Client link
90 daysWho gets it: Someone you ask
Shows: Everything assigned to them
Revoked when: A new link is created, or staff withdraw it
Request email link
30 daysWho gets it: The recipient of a request email
Shows: That one request
Revoked when: The request is reassigned or deleted
Reminder link
30 daysWho gets it: The recipient of a scheduled reminder
Shows: Their outstanding requests
Revoked when: Their client link is withdrawn
Phone upload link
30 minutesWho gets it: Whoever scans the QR code
Shows: One request’s reply box
Revoked when: It expires
Password reset link
1 hour, single useWho gets it: A member of staff
Shows: The new-password form
Revoked when: It is used, or a newer one is requested
Invitation link
7 days, single useWho gets it: A new member of staff
Shows: The set-password form
Revoked when: It is used, or a newer one is sent
In detail
How each part is locked down
A copy of the database opens nothing
Every link and session is a random 256-bit token, and the database stores only a SHA-256 digest of it, so a copy of the database is not a copy of anyone’s access. Staff passwords are hashed with scrypt, a memory-hard function, and checked in constant time. The settings are stored with each hash, so they can be raised later without resetting anyone.
Guessing gets nowhere
Eight wrong passwords lock that account for fifteen minutes. Five password-reset or client-link requests do the same for that address. The sign-in, reset and client sign-in forms give the same answer for known and unknown addresses, so nobody can use them to find out who has an account.
A second key for your team
Any member of staff can turn on two-factor sign-in: a six-digit code from an authenticator app that cannot be used twice, with eight single-use recovery codes for a lost phone. The team list shows who has it on, and if a colleague loses both phone and codes, an admin can remove it, which is written to the activity trail. The steps are in Two-factor authentication.
Sessions that end
Sessions live in an HttpOnly cookie that scripts on the page cannot read. A session lasts 12 hours unless the person chose to stay signed in, in which case it lasts 30 days and extends with use. Where you are signed in lists every device with its network address, and Sign out other devices ends them all. A new password, or removal from the team, ends every session at once.
Each person sees only what is theirs
Staff are an admin, a team member or a viewer, who can read but not change, and any of them can be limited to the clients and packs they are given, checked on every request. Someone you ask sees a request only if it is assigned to them, belongs to their party or is shared with the whole room, and a client link never shows your internal notes. In a data room, bidders see the index and the seller’s documents but never each other’s questions or names.
Files checked at the door
Accepted types are PDF, images, Word, Excel, PowerPoint, CSV, text and ZIP, up to 8 MB a file and 40 MB a reply; anything else is refused before it is stored. For the types with a fixed signature, the first bytes must match the type a file claims to be, so a renamed program is refused rather than stored. Only PDFs and images open in the browser; everything else downloads. Nothing is sent to anyone to be read, indexed or trained on.
The application locks its own doors
Every page is served with a strict Content Security Policy, so it runs only its own code. It refuses to be framed by another site, tells the browser never to guess a file’s type, and keeps its referrer to itself. Every database query is parameterised, and every link in an email is HTTPS: the application refuses to send one that is not.
A trail you can show
Every reply, edit, handoff, link created, link withdrawn, reminder sent and archive downloaded is recorded with the person, the time and the request. The trail cannot be edited from the application, and it exports as CSV.
Backed up every night
Every night the database and every uploaded file are written into one archive, using SQLite’s online backup so the copy is consistent while the app is in use, and the newest 30 are kept. Each is listed under Backups on the Settings page with its size and file count, so an admin can see that last night’s ran, take one by hand with Back up now, or download any of them. Restore is one documented command, and you never depend on our copy: Download files exports any client as a ZIP at any time. The detail is in Backups and restore.
Deleting means deleted
An admin can delete a client or remove a member of the team; any member of staff can delete a request pack, or a person from a client. The requests, replies and files go from the database and the uploads folder at once, and the deletion is recorded with who did it and when. After that, the data is only inside the nightly backups, which are kept for 30 days. Who can delete what is in Deleting data.
Who runs it, and who else is involved
Docsroom is made and run by ONAF Limited, a company registered in England and Wales (12589383) and with the Information Commissioner’s Office (ZB643670). You control the data you collect, and we process it for you. Email goes through Resend, over HTTPS, with the key held on the server, and OpenAI is used only if an administrator connects it, when it receives the description typed into the drafting box and never a document. The rest is in our privacy notice.
Found something? Tell us
If you believe you have found a security issue, email security@docsroom.co.uk. We read everything, reply within two working days, and will tell you what we changed.
Ask us anything on this page.
Free for 14 days, no card. We will answer in writing, from the people who built it.