Skip to content
Dokeo
Scan a draft

Trust

Security

Dokeo is a content quality gate. Here is how we handle data, isolation, and the determinism of the gate.
Contact
What is a content quality gate?
dokeo.co/blog/what-is-a-content-quality-gate
WARNING
76overall
77SEO
86AEO
66GEO
Fix before it ships12 of 19 checks pass
internal_linkingNo contextual links found (internal or external)
Fix
slopquestion-then-answer pattern found 2 time(s)
Fix

We gate our own blog. Scored 17 October 2026 with the same engine you get, glossary rules, balanced strictness.

This page states what is true today. Planned work is on the roadmap. For the full picture, see our Privacy Policy.

What we store

Submitted content is processed to generate a verdict. Draft text can be stored in workspace Core objects, saved drafts and review records alongside scan results. See the retention and deletion information in our Privacy Policy.

Encryption

All traffic to dokeo.co and the scoring API uses TLS (HTTPS) in transit via Vercel, Modal and Supabase. Data at rest is encrypted by the hosting providers (Supabase disk encryption). Stored credentials and secrets are also encrypted by Dokeo with Fernet (AES-128-CBC with HMAC).

Access

API keys are stored only as SHA-256 hashes and checked in constant time. Pixel tokens and webhooks are HMAC-signed. Session cookies are HttpOnly, Secure, and SameSite=Lax. All user-supplied URLs (batch scans, webhook deliveries) are SSRF-guarded before we fetch them.

Determinism

Scoring is deterministic code. There is no model in that path, so the same draft returns the same verdict.

Row-level security

Row-level security is on for every Dokeo table, and a test fails if a table ships without it.

Payments

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. We never see or store your card details.

Data residency

We run single-region today (US). Multi-region with EU/MENA data residency is planned but not live - we won't claim regional residency until it's actually shipped and holding your data.

Subprocessors

  • Modal - application hosting for the API (US East)
  • Supabase - database for accounts, scans and settings (US East)
  • Cloudflare - DNS and edge network in front of dokeo.co
  • Vercel - marketing site and app front end
  • Paddle - payment processing as Merchant of Record
  • MiniMax - writing and rewrites requested by users
  • Zhipu AI (z.ai) and Anthropic - optional writing providers
  • OpenRouter and selected upstream hosts - optional model routing, subject to a provider review
  • Nango - source authentication and proxying, when enabled
  • Composio - sign-in and token storage for connected third-party apps, when enabled
  • Brevo - account emails, when enabled

Compliance

We haven't completed a SOC 2 audit yet - we're a small team and haven't claimed one we don't have. If you need a security questionnaire for procurement or a product walkthrough, email [email protected].

Reporting a vulnerability

Found an issue? Email [email protected] with details and we'll respond within one business day.