LockDoc lets professional firms send files from Gmail and Outlook and receive client documents through a secure upload portal. It is built so that LockDoc itself cannot read your documents.
LockDoc's security practices are reviewed regularly against the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality), control by control, to keep them fully aligned.
Encrypted documents are stored in Cloudflare R2. The application and database run on OVHcloud servers in the United States. The vendors that help run LockDoc, and what each can see, are listed in the Privacy Policy. None of them can read your documents.
Team admins have an activity log with CSV export covering uploads, downloads, sends, deletions, sharing and member changes. Every user can see and export their own account activity. Records are kept for one year.
Files are kept for your plan's retention period (Team admins can set a shorter limit) and deleted automatically when they expire. Deleting a file or closing your account deletes the documents immediately. Encrypted database backups, which hold no document contents, expire within 30 days.
The database is backed up nightly, encrypted, to a separate off-site location, and restores are tested periodically. Encrypted documents are stored in Cloudflare R2, which keeps redundant copies.
LockDoc has a written incident response plan. If LockDoc becomes aware of unauthorized access to your information, you'll be notified within 72 hours, with what happened, what data was involved and the steps being taken.
The Terms of Service include a Data Security section for customers who handle personal information.
Questions: [email protected]
What if my computer dies, or I forget my passphrase? Your encryption key is a very long secret code. It's too long to type, so it's locked by your passphrase and kept in your account. The passphrase is the part you carry, in your head or a password manager. It never leaves your device and is never sent to LockDoc's servers. If your computer dies, or you want to use LockDoc on another device, you sign in, enter your passphrase, and you're in.
The flip side is that only you know the passphrase, so LockDoc can't reset it for you. If it's lost, files locked with the old key can't be opened. A password manager covers it.
What does LockDoc ask for when I sign in with Microsoft, and what does the Outlook add-in see? "Sign in with Outlook" asks only for your basic profile (name and email) to confirm who you are, and nothing about your mailbox. The Outlook add-in works only on the email you're writing. It inserts the secure link, and when you press send it checks the link is there and records the recipients so the passcode can be delivered. It doesn't read your inbox or other emails.
Who is behind LockDoc? LockDoc is a product of Kitzer, LLC, a New York company formed in 2023. LockDoc launched in 2024. Questions go to [email protected].
What if LockDoc ever shuts down? You'd get at least 90 days' notice by email, with time to download your files.
Is there a contract that covers client information? Yes. Section 7 of the Terms of Service covers safeguards, vendors, 72-hour notice of unauthorized access, and deletion, written to meet the service-provider requirements of laws like Massachusetts 201 CMR 17.00.