Nobody should see your data. Not even us.

User access is tightly controlled through roles and permissions in different modules of Docyt and activity in those modules is also logged.

When you sign-in to Docyt from your authenticated device, your PIN and the dual-control key is used by Docyt servers to decrypt and retrieve your unique secure key. We then use this secure key as a password for the AES-256 bit encryption that encrypts every document or data that you upload. Even the sensitive fields for documents (SSN, account numbers) are encrypted using the same mechanism as the document files. Hence all data that sits in our disks is encrypted and can only be decrypted by your device. In the extreme case of physical theft of our disks, all such encrypted data on them will be useless.

The RSA-2048 bit and AES-256 bit encryption algorithms are widely accepted as the highest level of encryption algorithms for bank and military grade security. Anytime your secure keys or PIN are in transit, between our servers or between your web browser or phone and our servers, the communication is encrypted using HTTPS+TLC.

No. Docyt does not see or store your login ID and password when retrieving data from financial institutions. Docyt works directly with banking technology partners like Plaid to connect with the bank and credit card institutions and in the process never sees the user’s credentials.

When you share a document with another Docyt user, Docyt gives this other user’s secure key access to this document. When you revoke their access, we revoke their secure key’s access to your document.

It is important to note that these protections do not extend if you email a document or export the document out of Docyt to other applications.

We save your secure key in your iPhone’s iCloud Keychain. This is a rock solid secure framework built by Apple to secure your passwords and other sensitive information. When you provide your PIN to sign-in to Docyt, you are essentially opening the lock on iCloud Keychain. If you forget your account PIN, and click on the “Forget PIN” link, we ask for your phone number and send a secret code via text message to the primary phone number connected with your account. Upon providing this secret code, we let you set your new PIN, which unlocks iCloud Keychain and retrieves your secure key. We then encrypt this secure key with your new PIN.

Read about how Apple iCloud Keychain works.

If your phone is stolen, to access your data someone needs to first be able to get past your iPhone PIN as well as your Docyt PIN. We recommend enabling and setting up your fingerprint or facial recognition on your phone for an extra level of security. With fingerprint or facial recognition enabled, Docyt will ask for your fingerprint or facial recognition before displaying any information about your extra sensitive documents (SSN, account numbers, tax documents, etc.).

We highly recommend that all Docyt users keep their phones locked with a strong PIN and enable the manufacturer-provided fingerprint or facial recognition authentication.

Your Docyt account is strongly tied to your primary phone number, which you used to create your account. We use your primary phone number to send a secret 2-factor authentication code by text message anytime we detect a major change in your account or if you are requesting a reset of your Docyt PIN. If you lose access to this primary phone, the only way to continue with Docyt will be to talk to your telecom service provider and regain control of your primary phone number. After you regain control of your phone number, you can use a new phone device, install Docyt on it, and provide your Docyt PIN during sign-in. At this point, if you have forgotten your PIN, your data cannot be loaded on your new phone and is lost forever. If you correctly provide your PIN, and enter the secret code sent on your primary phone number, Docyt app will re-download all your data back.

We do allow you to add your account on multiple devices, but the primary phone number is where we always send the 2-factor authentication code. We highly recommend not to use Docyt with phone numbers you may lose access to.

You should always enable Touch ID and Face ID on your iPhone for additional security.

You are still protected with Docyt, as long as your PIN is not compromised. In order for someone to access your account data using the hacked phone number, they still need a phone device containing a copy of your secure key. This secure key is downloaded from our servers to a new phone device only when a correct PIN decrypts the encryption on our server. Without the PIN, the hacker can’t see your data.

If you lose access to your phone number, we recommend that you try to recover it by working with your cell phone carrier. Once recovered, update your PIN immediately.

If you cannot regain access to your original phone number, you need to login to a device that is authorized with Docyt and update it with your new phone number.