How Dokira protects your data
This page describes how Dokira's security is designed. It is not a legal guarantee; the binding texts are the privacy notice and the terms of service.
Separation between organisations
Every database query is limited to your organisation (and client, where relevant). Automated tests cover every route that takes an ID, so one organisation's data cannot be seen by another.
Encryption
Traffic is encrypted with TLS. Bank account numbers, MyInvois credentials and identifiers of individuals (such as the TIN of an individual supplier) are stored encrypted at column level. Database backups are encrypted.
Virus scan of every file
Every uploaded file is scanned with ClamAV before processing. If the scan cannot run, the file is not processed (fail-closed). An infected file is deleted at once and the admins are told.
Bank account masking
Screens only show the last 4 digits of a bank account number. The full number is only used to compare supplier accounts for the bank-account-changed alert.
Logs without document content
Logs do not contain document content, TINs or bank account numbers.
Retention
Original files and page images are deleted from the server after 30 days by default. Admins can choose right after processing, 7, 30 or 90 days. Documents that are not yet approved or rejected are kept until decided, for at most 90 days after upload. Extracted data is kept for the life of the subscription and 90 days after cancellation.
AI providers
Only Dokira's servers talk to AI providers. AI keys are never in an app. Our AI provider is Anthropic (Claude, United States): it receives page images and document text. Bank account, MyKad and card numbers in the text are replaced with placeholders before sending; page images are sent as they are. DeepSeek is switched off for the whole service, and no other AI provider receives your data.
Location and cross-border transfers
The application servers and database are in Kuala Lumpur, Malaysia. File storage, the network and traffic protection (Cloudflare), the AI providers and other sub-processors are cross-border transfers and are disclosed in the privacy notice.
Signed approvals
Level-two approvals on a phone are signed with a biometric-protected device key (Secure Enclave on iPhone, Keystore on Android). There is no passcode fallback. Biometric data never leaves the device. On Windows, approval requires the Dokira password verified by the server.
Accounts and sessions
Passwords have at least 10 characters and are checked against a list of common passwords. Accounts are locked temporarily after many failed attempts. Access tokens expire in 15 minutes and refresh tokens rotate, with reuse detection. Sign-up is protected by Cloudflare Turnstile and rate limits.
Audit trail
Changes to documents, approvals, settings and memberships are recorded with the user and time.
Questions firms ask
- Where is the data stored?
- The application server and database are in Kuala Lumpur, Malaysia. Document files are stored in Cloudflare R2 with an Asia-Pacific location hint, which does not guarantee the data stays in Malaysia. The AI providers are outside Malaysia and are disclosed in the privacy notice.
- Who can see our clients' documents?
- Members of your organisation, according to their roles. No Dokira staff member can open your organisation through the apps. The operator of Dokira, who manages the servers, has technical access to the database and logs, and uses it only to run, repair and protect the service, to answer your requests, or when the law requires it.
- How is data deleted?
- Original files are deleted after the retention period the admin chooses (30 days by default). Extracted data is kept for the life of the subscription and deleted 90 days after cancellation. Dokira is not a records archive; the firm or client stays responsible for keeping the original documents.
- What is Dokira's role under the PDPA?
- For the data in your clients' documents, your organisation is the data controller and Dokira processes it on your organisation's behalf, under the data processing terms in the terms of service. For user account data, the data controller is the company that operates Dokira, as stated in the privacy notice. We do not claim any certification.
Reporting a security issue
If you find a vulnerability, email [email protected]. Include steps to reproduce it and do not include real customer data. We will reply within 1 working day. Do not test against other organisations' data.
Contact details are also in the security.txt file. /.well-known/security.txt