DOKIMA

Legal

Dokima Privacy Notice

Last updated: 19 October 2026

1. Who we are

Northloom Ltd (company number SC895860) is the controller of the personal data described in this notice. Northloom Ltd is registered in Scotland at 5 South Charlotte Street, Edinburgh, EH2 4AN. In this notice, “Northloom”, “we”, “us” and “our” refer to Northloom Ltd. Dokima is a Northloom product.

Contact us about privacy or legal matters at contact@northloom.ai. Product support is available at support@dokima.net and security reports may be sent to security@northloom.ai.

2. Scope

This notice covers personal data we process in connection with dokima.net, sales and trial applications, customer administration, licensing, billing, support, product-security reports and business communications.

Dokima is a business-to-business product. It is not intended for consumers or children.

3. Information we collect

Depending on how you interact with us, we may collect:

  • Business contact data: name, work email address, telephone number, job title, employer, business address and correspondence.
  • Sales and trial data: organisation details, intended use, repositories and team size, procurement information, application answers and our assessment or approval notes.
  • Account and licence data: username, stable internal account identifier, password hash, optional passkey public keys and credential metadata, email-verification records, invitations, memberships, roles, private publishing installation identifiers and access/audit events; customer organisation, plan, authorised contacts, licence or entitlement identifiers, activation and expiry information, product version and basic service events needed to provide and protect the licence.
  • Billing data: billing contact, billing address, tax information, subscription, invoice and payment status. Stripe processes full payment-card details; we do not receive or store the full card number or security code.
  • Due-diligence data: information required for customer, sanctions, restricted-party, destination and end-use screening, including information about organisations, directors, beneficial owners or authorised representatives obtained from you or reputable public and commercial sources.
  • Support and security data: support requests, diagnostic material you choose to provide, communications, reports submitted to us about the security of Dokima or our services, and our response records.
  • Website and security data: IP address, date and time, requested page, user-agent and related server or security logs. The website records a small set of first-party funnel paths in those ordinary server logs (for example, that a visitor opened the trial flow or advanced a form step). These event requests suppress the referring page, contain no form contents, email address, licence credential or Checkout token, and use no analytics cookie or external tracking provider. The website currently requests font files from Google Fonts, which may receive request information such as an IP address and browser details.
  • Marketing preferences: whether you wish to receive or stop receiving relevant product communications.

4. Source code, findings and AI runners

Dokima is installed and run in the customer’s environment. Local HTML reports are always generated. Before any optional private-team upload, a user confirms either private Dokima.net publishing or local HTML reports only. Existing installations without a choice receive the same prompt. Selecting an option by default does not itself start an upload.

When private publishing is enabled and linked to an organisation, Northloom receives worker status and the latest complete report, including findings, vulnerability descriptions, evidence, repository/component names and remediation. Evidence may include source excerpts, paths or personal data. This feature does not upload repository checkouts, runner prompts, credentials, raw runner logs or complete local state. Local-only operation does not send these reports to Northloom. Publishing failures do not stop local reviews.

Hosted reports are available only to invited organisation members. Organisation owners/admins manage invitations and installation credentials; viewers read reports. Owners manage billing and licences. Upload credentials cannot read reports or manage accounts. Removing a membership denies subsequent access, including from existing sessions; it cannot recall material already downloaded. Disabling publishing stops future uploads, while an owner/admin can separately delete hosted data.

We process hosted customer report data on the customer’s instructions under the hosted data-processing terms, rather than for marketing or public disclosure. We process account, invitation, licensing, billing and service-security information for the administrative purposes below. Accounts use case-insensitive usernames and salted Argon2id password hashes, plus optional passkeys (public keys and credential metadata, never biometric data). We retain stable internal account IDs, contact email, explicit email proofs, organisation memberships and roles; existing identities are never merged by matching email. To reject compromised passwords, we send only a five-character SHA-1 hash prefix to Have I Been Pwned’s Pwned Passwords range API, with response padding; we never send the password or its complete hash. Password checks fail closed when that service is unavailable. Secure first-party cookies maintain sign-in for up to 12 hours (the most recent 20 sessions per account), record authentication method/freshness, and bind five-minute passkey ceremonies. These are essential access cookies, not analytics cookies. Users may require passkeys: password sign-in and email recovery then stop, existing sessions are revoked, and support cannot override the requirement. Another authenticated organisation owner may invite a replacement account; that does not recover the inaccessible account.

The free open-source disclosure path is separate from optional private team publishing. That disclosure path does not upload repository checkouts; it sends only the individually encrypted qualifying findings described below. Optional private team publishing, when separately enabled, follows the team-report data flow above and does not replace the open-source disclosure requirement. Dokima uploads a finding only when it marks that finding fully_valid or possibly_valid, encrypting it individually on the customer machine before it leaves. Rejected and unverified findings are not uploaded. Each uploaded finding is kept private for 120 days from its first promotion to either qualifying state and is then released publicly with the affected open-source project identified by name. A later change from possibly_valid to fully_valid does not restart the private window. A retracted finding is reconciled before publication and is not published. The open-source licence does not offer a private-report opt-out; organisations that require qualifying findings to remain private must use a paid licence.

A customer may configure a third-party or local AI runner. The runner is selected and controlled by the customer and may receive source code, prompts and related review context directly from the customer’s environment. Northloom does not receive that material through the runner. The runner provider’s terms and privacy practices apply independently, and customers must assess them before use.

Customers should remove unnecessary personal data and secrets before voluntarily sending support material to Northloom. Any future change to these data flows will be described here before it is introduced.

5. Why we use information and our lawful bases

We use personal data to:

  • assess and respond to enquiries and trial requests (our legitimate interests in developing customer relationships, and contractual necessity where the individual is personally a party);
  • create and administer subscriptions, licences, product access, support and renewals (our legitimate interests in performing and administering business contracts, and contractual necessity where the individual is personally a party);
  • invoice, account for payments and meet tax, corporate and record-keeping duties (contractual necessity and legal obligation);
  • conduct customer, sanctions, export, destination and end-use checks and prevent fraud or misuse (legal obligation where applicable and our legitimate interests in lawful, responsible trade);
  • secure our websites, systems, licences and product, investigate abuse and handle vulnerability reports (legitimate interests and, where applicable, legal obligation);
  • establish, exercise or defend legal claims (legitimate interests and legal obligation); and
  • send relevant business-to-business product communications where permitted (legitimate interests or consent, as required).

Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights override them. You may object to processing based on legitimate interests.

Standard paid and trial applications may be checked and approved automatically from the information and confirmations submitted, including registered country, confirmation of use only in supported countries, declared contributor count, prior trial use and any existing block or suspension. Applications that do not pass those checks are held for human review rather than automatically declined. Free open-source applications always receive human review. These decisions concern supply to an organisation; you may contact support@dokima.net to request review or correct an application.

6. Who receives information

We disclose personal data only where reasonably necessary to:

  • service providers supporting website hosting and security, business email and productivity, billing and payments, customer support, software delivery and business administration;
  • professional advisers, auditors, insurers and prospective investors or purchasers under appropriate confidentiality duties;
  • government, law-enforcement, tax, sanctions or regulatory authorities where required or reasonably necessary; and
  • another entity in connection with a reorganisation, financing, sale or transfer of all or part of our business, subject to appropriate safeguards.

Current core providers include Vultr for website and account infrastructure in Manchester, United Kingdom, Backblaze B2 for encrypted recovery storage in Amsterdam, Netherlands, Google Workspace for business email and documents, Stripe for billing and payments, and Resend for transactional verification, recovery, invitation, licence and download email, and Have I Been Pwned for privacy-preserving compromised-password checks. We do not sell personal data.

7. International transfers

Some providers may process personal data outside the United Kingdom. Where UK data-protection law requires a transfer safeguard, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, or another lawful mechanism. Contact us for further information about safeguards relevant to your data.

8. Retention

We keep personal data only for as long as reasonably needed for the relevant purpose:

  • unsuccessful sales and trial enquiries: normally 24 months after the last substantive interaction;
  • contracts, customer administration, invoices, payment and screening records: normally for the customer relationship and 6 years afterward;
  • ordinary support records: normally 3 years after closure;
  • reports submitted to us about the security of Dokima or our services: normally 6 years after closure, where a longer record is useful to track product risk and disclosure history; private team reports uploaded at a customer’s request have the separate, shorter report retention described below;
  • vulnerability information uploaded under the free open-source licence: kept private for 120 days from the finding’s first fully_valid or possibly_valid promotion and then released publicly with the affected project identified under the open-source programme terms;
  • website and security logs: normally 30 days, unless an event requires longer investigation or preservation;
  • direct-marketing records: until opt-out or normally 24 months after the last meaningful engagement; and
  • legal disputes or regulatory matters: for as long as required to resolve the matter and meet related legal duties.

Encrypted recovery backups can retain deleted data for years after deletion from the active service. The managed schedule retains snapshots from the most recent 48 hours, plus 30 daily, 12 weekly, 24 monthly and five yearly snapshots. These recovery copies are stored separately in Backblaze B2, are restricted to authorised recovery operations and are not available for ordinary account or report viewing. The 30-day inactive-report expiry below applies to active hosted payloads; it is not a promise to erase every recovery copy within 30 days. Before restored data becomes accessible, deletion, revocation and current access-policy records must be reconciled and reapplied; otherwise the restored account service stays closed. We may retain anonymised information that no longer identifies an individual.

Private publishing stores only the latest complete report per installation. Report and status payloads expire after 30 days without installation contact, with hourly cleanup. Account-area deletion immediately removes the active hosted payload and revokes its credential. Encrypted recovery backups expire under the existing managed backup schedule and are not used for ordinary viewing; if restored, deletion and revocation records must be reapplied before access reopens. Invitations and mailbox proofs expire after 24 hours; pairing transactions after ten minutes, passkey ceremonies after five minutes and password reset proofs after 15 minutes; browser sessions after 12 hours. Expired transaction records are cleaned hourly. Account, membership and audit records are retained while needed to provide and secure the organisation account; contact us to request account/organisation deletion, subject to legal and billing retention duties.

9. Security

We use proportionate technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration and disclosure. No system can be guaranteed completely secure. Please send suspected product or service vulnerabilities to security@northloom.ai and do not include unnecessary personal data.

10. Your rights

Subject to applicable law and exceptions, you may ask us to:

  • provide access to your personal data;
  • correct inaccurate or incomplete data;
  • erase data;
  • restrict processing;
  • provide certain data in a portable format;
  • stop processing based on legitimate interests; or
  • withdraw consent where consent is the lawful basis.

You may opt out of marketing at any time. To exercise a right, contact contact@northloom.ai. We may need to verify your identity and authority. You may complain to the UK Information Commissioner’s Office at ico.org.uk, although we invite you to contact us first so we can try to resolve the issue.

11. Territorial availability

Northloom presently offers Dokima only to approved business customers established in the United States, Canada, the United Kingdom, Australia, New Zealand, Jersey, Guernsey or the Isle of Man. Website controls may restrict access from other locations. Those controls are not a substitute for customer due diligence and may not always identify a visitor’s location accurately.

12. Changes

We may update this notice when our product, providers or legal obligations change. We will post the current version with a revised date and provide additional notice where a change materially affects individuals.