Security measures

Last verified: 2026-10-08

Documentr uses several layers:

Self-hosted authentication: single-use magic link or 8-character code in the web app and on the iPad (short-lived). Organizations can additionally enable password login.
Limits on login and registration attempts
HTTPS transport encryption
Schema-based tenant isolation in the cloud database (Solo and Cloud)
Roles in Cloud organizations, viewers read-only on the server — Roles & permissions
Audit log of changes in the cloud
Automatic backups of the cloud database and uploaded images (Solo and Cloud)
Manual on-device backup/restore as .docr.bak (SQLite snapshot + images)
Offline license stored on the iPad, bound to the device lock — Offline license
Archive PDF with SHA-256 integrity proof after finalization, verifiable online without upload — PDF export

Backups

Solo and Cloud: Documentr backs up the cloud database and uploaded images automatically. That is an operational safeguard — not a restore button in the app.

All product lines: You can also create a manual .docr.bak on the iPad under Settings.

Offline: There is no cloud copy. Regular .docr.bak archives are the only backup.

The local app database currently uses SQLite; additional encryption (e.g. SQLCipher) is planned but not the default yet.

See also: EU data hosting, GDPR & privacy.