Docs for teams that read the threat model first
Security products need accurate docs, and a docs platform that holds up to your own review: hashed secrets, enforced 2FA, an audit log and self-hosting.
A platform you can review
The defaults your own security team would ask for.
Hashed secrets
Session cookies and API tokens are stored only as hashes, and 2FA secrets are encrypted at rest.
Learn more2FA with replay protection
TOTP codes can’t be reused, recovery codes work only once, and repeated failed sign-ins lock the account.
Learn moreCSRF protection
Requests that change data and come from a browser session must come from the app’s own origin.
Learn moreKnow who did what
Incident response starts with a reliable record.
Organization audit log
Membership, role, site and content events, with configurable retention.
Personal security log
Each member sees their own sign-ins, new devices and security changes.
Reviewed changes
Change requests keep the author, the reviewers and the approvals together with every docs change.
Learn moreDocs for advisories and integrations
Publish what customers need quickly, and keep everything else internal.
Fast, reviewed publishing
Draft an advisory in a change request, get it reviewed, and merge it straight to the live site.
Public and unlisted sites
Public docs for everyone, and unlisted sites for material shared only by link.
Learn moreSelf-hosted
Run Docsheaf in your own cloud with your own Postgres and S3-compatible storage.
Frequently asked questions
How does Docsheaf store credentials?
Passwords are hashed, session and API tokens are stored only as hashes, and TOTP secrets are encrypted with a key you provide.
Can we enforce two-factor authentication?
Yes. Admins can require 2FA for the organization, and members without it are blocked from organization resources until they turn it on.
Is there an audit log?
Yes. The organization audit log records membership, role, site and content events, and each user has a personal security log. You can configure how long entries are kept.
How do we report a vulnerability?
Email our security team. The Security page explains how to report an issue and what we do with it.
Can we stream audit events to our SIEM?
Not yet. Streaming audit logs to a SIEM is on the roadmap. Today admins can export the audit log as CSV.
Accurate docs. Better answers.
Start writing for free, or talk to us about bringing your team and your existing docs.