Security overview

The Service is hosted on cloud infrastructure providers that maintain recognized security and compliance certifications. Production environments are isolated from development and testing, and access to production systems is restricted and logged. We rely on our providers’ physical and environmental controls for the data centers that host the Service.

Data in transit between your device and the Service is encrypted using TLS. Credentials and other sensitive secrets are encrypted at rest using industry-standard algorithms and never stored in plaintext. Backups, where used, are also encrypted.

Access to systems and customer data is granted on a least-privilege, need-to-know basis and is reviewed regularly. Internal access requires unique accounts with multi-factor authentication. Administrative actions are logged and monitored. We do not grant standing access to customer User Content except where strictly necessary to operate, support, or secure the Service.

User authentication is handled through a dedicated authentication provider that supports secure session management. We encourage users to enable multi-factor authentication where available, to use strong, unique passwords, and to protect their account credentials. You are responsible for keeping your credentials confidential; see our Terms of Service for more on account responsibility.

We engage a limited set of sub-processors to help run the Service — for hosting, authentication, payment processing, email delivery, analytics, and AI capabilities. Vendors are evaluated for security before engagement and placed under appropriate contractual obligations to protect data. We configure and contract with our AI providers to limit training on your data where the provider offers that control.

Payment processing is handled by our payment processor. We do not store full card numbers on our servers. Card data is handled by the processor in accordance with the PCI DSS standard.

We monitor the Service for anomalies, abuse, and potential security events, and we maintain an incident response process. If a security incident affects you, we will notify you as required by applicable law. We continuously work to improve our controls as the threat landscape evolves.

We retain personal information only as long as needed to provide the Service and to meet legal, billing, security, and audit obligations. You can request deletion of your account and personal information as described in our Privacy Policy, subject to legal retention requirements.

If you believe you have discovered a security vulnerability in MarkDocket, please report it responsibly to security@markdocket.com. We ask that you avoid accessing, modifying, or deleting data that does not belong to you, and that you give us a reasonable opportunity to investigate and remediate before any public disclosure. We appreciate responsible reports and will acknowledge them as promptly as we can.

For security questions or concerns, contact us at security@markdocket.com. For all other questions, contact hello@markdocket.com.