Security & data handling
Dokima runs in your workspace and delegates analysis to the AI runner you configure: Claude, Codex or OpenCode. Review state and local reports stay on your computer. Findings and status are uploaded for visibility to the rest of your team only if you explicitly approve private team publishing. With hosted models, source and prompts are processed by the configured provider. OpenCode also supports privately hosted local models; where data goes depends on your endpoint and configuration. Here is what your team controls.
Dokima controls
.dokima/Your runner controls
Runner permissions
Shipped runner profiles use read-only or sandboxed modes where the runner supports them. Dokima snapshots its state, makes it read-only during a run and rejects work if a runner attempts to change canonical state directly.
A customer can override runner configuration for its own environment. Any such override should be reviewed against the customer’s security requirements.
Private team publishing
Dokima does not upload findings or review status to your team until you explicitly confirm private team publishing and approve the installation in your team account. Once enabled, publishing keeps your team’s private reports up to date; you do not need to approve each individual finding.
Choose local HTML reports only to keep findings on your computer. You can change your publishing choice in Settings, and local HTML reports remain available with either choice. See team reportsfor setup and sharing details.
Organisation owners and admins can create named, expiring API keys for agents that need to review hosted findings. Each key can read reports from the selected organisation, including evidence and source excerpts. It cannot upload or change reports, manage members or access billing. Only a hash of the secret is stored, and admins can revoke access at any time. Read the agent API guide.
Practical controls
Dokima release binaries are provided for Linux and macOS.
dokima update retrieves the latest private release and refreshes shipped prompts.
State snapshots are created before mutating runs and after successful progress.
Remove the binary, .dokima/ state and generated report when you no longer need them.
Review the Privacy Notice,Subscription and Software Licence Terms,Trial Terms andAcceptable Use Policy for data handling, permitted use and licence obligations.
See what Dokima finds
Start a full-product 21-day trial for your engineering team. No payment card required.