Canonical: https://dokima.net/docs/data-handling/
Updated: 2026-11-04T23:30:51+00:00

Documentation

# Data handling

Dokima runs from your workspace. Its configuration, review state, logs, prompts, accepted findings and generated HTML report are stored locally.

## Local files

Dokima creates:

```
.dokima/
  config.json
  state/
  prompts/
  logs/
  backups/

dokima-report/
DOKIMA.md
```

The exact state files grow as review work is accepted. Backups are compressed, kept for up to 30 days and capped to the newest 50 archives.

Free and open source access never require finding uploads or public disclosure. Creating an account or activating a licence does not enable sharing.

## Optional private team publishing

Local reports are always produced. When you explicitly confirm Dokima.net publishing and connect an organisation, findings, evidence, repository/component names, remediation and worker status are sent over HTTPS to that private team. Report evidence can include source excerpts and personal data. Repository checkouts, runner prompts, raw logs, credentials and complete local state are not uploaded by this publishing feature.

Only the latest report is retained per installation; inactive report/status payloads expire after 30 days without contact, with hourly cleanup. Owners/admins can revoke upload credentials or delete the hosted installation. Turning publishing Off does not delete an existing hosted report. Copying `dokima-report/` to an internal server remains available; copied status visibly becomes stale if not refreshed.

See [sharing status and results](https://dokima.net/docs/team-reports/) for setup and access controls, and the [Privacy Notice](https://dokima.net/privacy/) for data handling.

## Minimal product telemetry

Updated clients send setup completion, review-job starts, accepted completions, coarse failure categories and successful report generation to the licensing backend. These events work independently of report publishing and contain no source, findings, paths, prompts, runner output or model names. They are linked to the licensed installation and retained for up to 90 days, with a backend storage cap. Failed deliveries are discarded and never change review results.

Set `DOKIMA_TELEMETRY=off` in the environment running Dokima to disable product telemetry. For a background worker, apply the setting to its service environment and restart the worker. Licensing and update requests remain necessary separately.

## Source processing

Dokima uses your configured command-line AI runner to analyse code. It supports Claude and Codex directly, and other models through OpenCode, including Gemini, open models and privately hosted local models. The runner receives source and project context needed for the task. Any model usage or hosting costs are separate from Dokima.

With a hosted model, that material is sent to the configured provider. With a model served on your own computer, inference can run locally. A private endpoint on another machine still receives the material over the network. Check your runner, provider, endpoint and any additional integrations before assuming that source stays on your computer.

How that material is transmitted, processed and retained depends on:

* the runner and model you choose;
* your provider account and organisation settings;
* provider terms and data-retention policies;
* any regional or enterprise controls you have enabled.

Do not treat “runs locally” as meaning source can never leave the computer. Review your runner configuration and provider commitments.

## Runner permissions

Default profiles use read-only or sandboxed execution where supported. Dokima also makes canonical `.dokima/state` read-only during a runner call, restores direct mutations and rejects the run if the runner attempted to change that state.

The customer can configure custom runner arguments. Any move away from the shipped read-only defaults is the customer’s decision and should be reviewed.

## Logs and deletion

Lifecycle logs are stored under `.dokima/logs/`. Detailed failure logs can include the generated prompt, runner command and runner output, so handle them as project-sensitive material.

To remove Dokima data from a workspace, remove `.dokima/`, `dokima-report/` and the optional `DOKIMA.md` file. Remove the installed binary separately. Back up any finding history you need before deletion.