Security is built into how okdoc handles documents and signatures. This page describes the concrete measures we have in place today. It does not claim any external certification; where we say something, it reflects what the system actually does.
All traffic to okdoc is served over HTTPS with TLS, and the service sends HTTP Strict Transport Security (HSTS) so browsers connect over an encrypted channel only.
Each organization's data is isolated at the database level using PostgreSQL row-level security (RLS). Queries are scoped to the acting organization, so one tenant cannot read or modify another tenant's data.
API keys are stored as hashes, not as plain text. The full key is shown once at creation; after that only its hash is kept, so a database read cannot reveal a usable key.
When your organization connects a payment provider, the provider credentials are encrypted at rest with AES-256-GCM before they are stored.
Outgoing webhooks are cryptographically signed so your systems can verify that a payload genuinely came from okdoc and was not altered in transit.
Sensitive endpoints are protected by durable rate limiting to reduce the impact of automated abuse and credential-guessing attempts.
Every completed document is sealed into a tamper-evident PDF with a certificate of completion and a SHA-256 fingerprint, backed by an audit trail of timestamps, IP addresses and signer details, so any later change to the file is detectable.
okdoc runs on established infrastructure providers, Supabase for the database, storage and authentication and Vercel for hosting, with data hosted in the EU.
We welcome responsible disclosure. If you believe you have found a security issue, please email security@okdocai.com with the details and we will respond as quickly as we can. Please give us reasonable time to address an issue before disclosing it publicly.
okdoc does not currently hold SOC 2, ISO 27001, HIPAA or PCI certification, and this page makes no such claim. The measures above describe our current practice and may improve over time.