If you believe you have found a security issue in BlokDuck, the Website or our infrastructure, please email [email protected]. Include enough detail for us to reproduce it: affected version, platform, the steps you took, and the impact you believe it has. Please use synthetic examples rather than real personal data.
We will acknowledge your report within three business days, keep you updated while we investigate, and tell you when a fix is available. We are grateful for reports and will credit you by name or handle if you wish.
Security reports and questions: [email protected]. We do not currently publish a PGP key; if you need an encrypted channel, say so in a first message without sensitive detail and we will arrange one.
BlokDuck is built so that sensitive content never needs to leave the machine it is on:
3.1 On-device processing. Detection, tokenisation and the protected copy are produced locally. Documents, protected copies, reports and key files are never uploaded to us.
3.2 No phone-home. The redaction engine collects no telemetry, performs no crash reporting and makes no update checks. Licence keys are validated entirely offline.
3.3 Local by default. The server binds to localhost
(127.0.0.1). The container image mounts a single folder and
opens no inbound cloud service.
3.4 Reversible only with your key. A protected copy can be restored only with the private key written beside it; the original file is never modified.
In the interest of transparency, these are the only moments our software or site contact the network. None of them send document content:
4.1 Browser interface libraries. When you use the app in a browser, the page loads fonts from Google Fonts and the PDF.js and jsPDF libraries from public content delivery networks. Those providers may see your IP address and browser details. Your documents are not sent to them.
4.2 Website analytics and logs. The marketing Website records aggregate visit information and standard server logs. See our Privacy Policy.
4.3 Payments. Card payments are handled by Stripe. Card details are entered with Stripe and never reach us.
4.4 Correspondence. Email you send us is handled by our email provider.
We use access controls, encryption in transit, least-privilege access and code review, and we audit dependencies for known vulnerabilities in continuous integration. Release builds are produced from a checked-in lockfile and shipped without runtime packers. No system is perfectly secure, and we do not claim a security certification we do not hold; if that changes we will say so here and in the changelog.
6.1 We follow coordinated disclosure. Please give us a reasonable opportunity to investigate and fix an issue before you disclose it publicly, and do not access, modify or delete other people’s data, degrade the service, or use social engineering in the course of research.
6.2 For good-faith research that respects these rules, we will not pursue legal action or ask law enforcement to investigate you.
6.3 Out of scope: third-party services (report those to the provider), physical attacks, spam, and denial-of-service testing.
6.4 We do not currently operate a paid bug-bounty programme.
If a security incident affects personal information, we will notify affected individuals and regulators where the law requires it, as described in our Privacy Policy.