Security built into every layer of Docsheaf
Strong sign-in, least-privilege roles, a complete audit trail and the option to run Docsheaf on infrastructure you control.
Account protection
Every account gets the same protections, whatever plan it’s on.
Two-factor authentication
Authenticator-app codes with replay protection, plus ten single-use recovery codes stored only as hashes.
Passkeys
Phishing-resistant sign-in with WebAuthn: use a fingerprint, face, device PIN or security key instead of a password, or as the second step after one.
Sign-in lockout
Five failed attempts lock an account for 15 minutes. Unknown emails take just as long, and resets never reveal whether an account exists.
Sessions and new-device alerts
See every signed-in device, sign out one or all others, and get an email when a new browser signs in.
Verified changes
Accounts start with an emailed code or a verified GitHub or Google account. Changing your password, email, 2FA, passkeys or connected accounts requires your current password and sends a notice.
Organization controls
Decide who can see, edit, review and publish — and see who did what.
Six roles
Viewer, commenter, reviewer, editor, creator and admin — enforced on every API route, not just in the UI.
Require two-factor
Admins can require 2FA — an authenticator app or a passkey — for the whole organization. Members without it — and their API tokens — are turned away.
Organization audit log
Members, roles, invites, spaces, sites, publishing and merges, filterable by person, action and date and exportable as CSV.
Personal security log
Every member can review their own sign-ins, failed attempts, password, email, 2FA and passkey changes, sessions and API tokens.
People outside an organization get “not found” rather than “forbidden”, so private spaces and sites don’t reveal that they exist. Audit events are kept for a configurable retention period — a year by default.
Data protection
Defaults that hold up when something goes wrong.
Secrets stored as hashes
Sessions, API tokens, recovery codes and one-time links are stored only as SHA-256 hashes; passwords use scrypt.
Encrypted 2FA secrets
Authenticator secrets are encrypted at rest with AES-256-GCM.
CSRF-resistant by design
Session cookies are httpOnly and SameSite. State-changing requests need JSON bodies and a matching Origin.
Safe content
Documents are validated against an allow-list of blocks; links can’t run scripts, and only known providers can be embedded.
Careful file delivery
Uploads are served as attachments where needed, with nosniff headers; storage keys never contain user-supplied names.
Rate limiting
Sign-in, sign-up, account and analytics endpoints are rate-limited.
Your infrastructure
Run Docsheaf where your data lives
Docsheaf keeps its data in standard services you can operate, audit and back up yourself.
- PostgreSQL for content, history, members and settings
- AWS S3 or a Cloudflare R2 bucket for uploads, chosen by configuration
- Your own SMTP provider for sign-up codes, resets and security alerts
- Every upload is a new immutable object, grouped by organization for lifecycle rules
PostgreSQL
Migrations run automatically when the API starts.
S3 or R2
Or local disk for a single server.
SMTP
Any provider that speaks SMTP.
Retention
Set how long audit events are kept.
On the roadmap
Planned for a later release.
Audit log streaming
Send audit events to your SIEM.
Report a vulnerability
If you believe you’ve found a security issue in Docsheaf, please tell us privately.
- Describe the issue, where it is and the steps to reproduce it.
- Only test against accounts and data that belong to you.
- Don’t run tests that degrade the service for other people.
- Give us a reasonable amount of time to fix the issue before you share it publicly.
Frequently asked questions
How are API tokens protected?
Tokens are shown once when you create them and stored only as hashes. They act with your permissions, and organizations that require 2FA reject tokens from members without it.
Can I export the audit log?
Yes. Admins can filter the organization audit log and export it as CSV, with protection against spreadsheet formula injection.
Where are uploaded files stored?
In the object storage configured for your deployment — AWS S3, Cloudflare R2 or local disk. Documents only reference files through Docsheaf URLs, never bucket URLs.
Docs you can trust, on a platform you can trust
Start for free, or talk to us about your security requirements.