Security

Your gate data is evidence. We treat it that way.

DockLedger holds the record of who arrived at your dock, when, and what happened. That record is only worth something if it is protected. Here is how we do that, in plain English, so you can forward this page to your IT or compliance team.

Last updated 19 October 2026

We attacked it ourselves, and wrote down what happened

On 6 September 2026 we came at the live site from the open internet as an anonymous visitor, holding only the key every browser is given. This is the whole result, including the finding that went against us.

Black-box test, 6 September 2026Anonymous · public key only

Results of the black-box security test of 6 September 2026
What we tried	Scope	Result
Read the database directly	every table in the public schema	permission denied
Call server functions	every server function	refused
Call the one public function with a forged token	1 function	returned nothing
Hit edge functions, with no credentials and with forged ones	all	401 / 403 / 404
List or download stored files	every storage bucket	nothing served
Scan shipped code for secrets	nine pages and the service worker	none found
Change anything at all	row counts	identical after
Flood the gate-search endpoint	1 endpoint	capped 14 Sep

The one finding is closed, and the delay was the point: a gate search has to stay fast for a busy gatehouse on bad wifi, and the wrong throttle turns a working gatehouse into a locked one. The first attempt at it did exactly that. It counted every request against one number shared by the whole site, so a single caller could have stopped every driver checking in. What is there now caps each calling network on its own and refuses only the caller who spent it. Follow-up sweeps since have each closed a door.

This was done by the people who wrote the code. That makes it evidence, not a certificate. It is worth exactly what you can verify, which is why the result is printed here in full rather than summarised as a badge.

How the wall is built

Three things, in the order they would have to fail.

Between companies. Each customer’s records are kept apart by the database itself

Every booking, check-in, pallet and document is stamped with your company at the moment it is created, and the database itself enforces the wall between companies. This is not a filter in the app that a bug could skip: a request for another company’s data gets nothing back, because the database refuses to serve it. We test that one customer cannot see, add, change or delete another customer’s records, and those tests pass.

Row-level security, enforced in PostgreSQL.

Inside your company. People only see what their job needs

Owner, manager, office and checker roles each unlock only their part of the system. Billing is owner-only, and a checker’s login works on the floor and nowhere else. Roles are set by your owner or manager, never by the person themselves. Anyone can turn on two-step sign-in, a code from an authenticator app after the password, and an owner or manager can require it for every office login in the workspace. Once someone has turned it on, the database itself keeps the workspace’s records closed to their session until the code has been typed, or until they sign in on a device they chose to trust after typing it. An owner or manager can stop devices being trusted across the workspace. What DockLedger’s own staff can see is set out in full further down this page.

With your partners. Carriers and suppliers see only their own deliveries

Each carrier and supplier gets a private portal link scoped to their deliveries alone, with nothing about your other partners in it. The link works like a password, so ask them not to forward it. The portal takes it out of the browser’s address bar as soon as the page opens. Connected telematics, Xero and Sage credentials are kept in a server-side vault, not in the browser.

Stored in London: Your records and files are stored in London, on Supabase (AWS eu-west-2). The site’s server functions run in London too, on Vercel. Static pages, like this one, are served from Vercel’s worldwide network. Traffic is encrypted in transit with TLS, with HSTS so browsers refuse an insecure connection. Your records and files are encrypted at rest.
What leaves the UK: Every company that handles data for us, what it receives and where, is listed in the privacy policy. Your records and files are stored in London, but some data does leave the UK: emails we send go out through Resend, in the USA; error reports go to Sentry’s data centre in the EU; the console assistant, the support chat and the delivery-note reader use Anthropic, in the USA; route planning uses TomTom, in the Netherlands; and our daily backup is prepared on our own machine in the UK, then encrypted and copied to Google Drive. The assistant sends your question and the counts, references, times, carriers and bays on the screen you are looking at, the names your staff use in DockLedger and any job title a signer typed, with the other personal fields removed first; phone numbers typed into notes are not removed. The support chat sends what you type. The delivery-note reader sends the photo, which can show names and signatures. Anthropic does not use any of it to train its models.
Backups: Your data is backed up every day, encrypted, and a copy is kept away from our main hosting provider. We have restored our backups into a separate, sealed environment and checked that every table and every stored file came back intact.
Private links expire: Delivery photos, paperwork and supplier-claim packs are kept in a private store with no public address. When you open one, DockLedger issues a link that works for one hour: long enough for a page left open on a desk to keep showing its photos, short enough that a copied link soon stops working. An invoice link stops working after five minutes.
Error reports: When something breaks, the error report goes to Sentry, in its EU data centre. Before it leaves, the app removes the tokens in web addresses, email addresses, phone numbers and the values in database key errors. There is no session replay, and we do not use IP addresses in error reports.
Your card never reaches us: Payments run end to end through Stripe. DockLedger never sees, stores or transmits your card number, so it is not ours to leak.
Registered and accountable: Registered with the UK Information Commissioner’s Office, registration ZC231614, operating under UK GDPR. Who we are and where to serve documents is published on every page. The registration is public, so look it up before you trust us with anything.

What DockLedger staff can see

Nobody at DockLedger reads your records in the normal course of work.

The support desk

Our support desk can read every customer’s support conversations, because answering them is its job. A message you send through the Help panel or the support page also goes to Anthropic to draft a reply, and a person at DockLedger reads the conversation when it is passed to us. Replies from our staff may be emailed to you. Our own support staff must type a two-step code every time they sign in to the DockLedger support desk; there is no “remember this device” for them.

The customer list

DockLedger’s administrators see one line per workspace: its plan, billing status and trial dates, how many members it has and when someone last signed in, activity counts for the last two weeks, whether each connected integration is working (and if not, the error it last reported), and how many support tickets are open. That screen shows no bookings, stock or documents.

Direct database access

The owner opens a customer’s records only to fix a problem, to act on that customer’s instructions, to investigate a security incident, or when the law requires it. A workspace export for a move to your own server is started only at your request, is recorded, and you are e-mailed when it begins. The AI assistants we use to build and run DockLedger are kept out of customer records by access controls. The only route they are given to the live database is read-only and shows a customer’s workspace only as counts. Every new workspace is treated as a customer’s, and we are emailed automatically if one is ever moved out of that class.

If something goes wrong

If personal data we hold is lost, exposed or changed without permission, this is what we do.

We contain it first: close the gap, revoke any keys or links that could be misused, and keep the evidence.
We tell the customers affected without undue delay, and within 72 hours of becoming aware of it. You will hear what happened, what data it involved, what we have done, and what you should do.
Where the law requires it, we report it to the Information Commissioner’s Office within the same 72 hours. For the records you keep in DockLedger you are the controller, and we give you what you need to make your own report.
If the breach affects your own account details and puts you at high risk, we tell you directly as well, in plain words, with what you can do to protect yourself.
If we discover a breach that affects data we hold from Xero, we tell Xero at api@xero.com within 24 hours.
We record every incident in a register, including the ones that did not need to be reported, and change what let it happen.

Found something? Tell us.

Email us about a security problem, a privacy concern or a request about your personal data. We acknowledge every report within 2 working days, and you will get a grateful response, never a legal threat. For everyday help, write to hello@dockledger.co.uk.

security@dockledger.co.uk Privacy policy

Rather see it for yourself? Start the free trial.

The same contact details, for security researchers, are in security.txt.