Dockli’s data-handling posture is simple to state: your file content stays in Microsoft 365, and the only data Dockli persists lives on the local device — a small set of state files, with anything sensitive encrypted. Nothing about your files is copied to a Dockli server.
File content stays in your tenant
Dockli reads and displays your SharePoint, Teams, OneDrive, and Hub Site files live through Microsoft Graph. It does not copy file content to any Dockli-operated or third-party server, and there is no cloud service in the middle that holds your files or your token. When you open, preview, edit metadata, or restore a version, that operation goes straight to Microsoft 365 as the signed-in user.
Because access is delegated (see Permissions and scopes), the data boundary is your tenant’s own permission model. Your data stays in your Microsoft 365 tenant.
Cross-tenant copy is still tenant-to-tenant
When a user copies a file between two of their own signed-in accounts, Dockli streams the bytes from the source tenant to the destination tenant using each account’s own delegated token. The content moves M365-to-M365 on the user’s behalf — it is not staged on a Dockli server.
What Dockli stores locally
All local state lives under %LocalAppData%\Dockli — specifically the Data\ subfolder, which is kept separate from the app’s install directory so it survives updates. The complete list:
| File | Contents | Sensitive? |
|---|---|---|
Data\msal_cache.bin | The MSAL token cache (access + refresh tokens for the signed-in accounts). | Yes — DPAPI-encrypted (CurrentUser scope). |
Data\accounts.json | The list of account identifiers the user added to Dockli, and which is active. | Identifiers only, no secrets. |
Data\settings.json | Small app state, including the signed-in identity (tenant id, user object id, email) used for telemetry and seat release. | Identity metadata, no file content, no tokens. |
Data\favorites-<account>.json | The user’s favorite locations, one file per account. | Names/paths of favorited items only. |
| Folder-color preferences | Per-folder color choices set in the UI. | Preferences only, no content. |
The token cache — the only file holding anything sensitive — is encrypted at rest with the Windows Data Protection API, tied to the current Windows user, so it can’t be read by another user or lifted onto another machine. See Authentication and tokens.
No file content is cached to disk
None of the local files contain your document contents. Dockli persists tokens, an accounts list, settings, favorites, and preferences — never the files themselves. File bytes are streamed from Graph as needed and rendered in the UI.
AI attachment handling
When a user attaches a document to an Ask Dockli conversation, Dockli extracts its text and holds that extracted text in memory only, in a store that evicts entries after a short time-to-live (about three hours) and by count. Raw file bytes are not sent to the AI model, and the extracted text is not written to disk. Full detail is in AI security.
Diagnostics and telemetry
Dockli emits best-effort, non-content diagnostic events to help operate the product — sign-in, startup, shutdown, warnings, errors, and crashes. These are posted to the Dockli portal at portal.tinytugboat.com.
What a diagnostic event contains:
- The event type (for example sign-in, warning, error, crash).
- The message and, for errors and crashes, the exception stack trace.
- Identity metadata: the Microsoft tenant id, the user object id, and the user email, read from the local
settings.json. - A timestamp.
What it never contains:
- No file content, file names of your documents, or folder contents.
- No access tokens or credentials.
Two properties matter for security review:
- Failure is swallowed. Telemetry is fire-and-forget; if the portal is slow or unreachable, the failure is logged locally and never surfaces to the user or blocks the app. An outage on the diagnostics endpoint cannot turn into a sign-in failure.
- No third-party analytics. The backend ships no third-party analytics or crash SDKs — there is no Application Insights, Sentry, or similar in the Dockli service. Diagnostics go only to the first-party portal.
Allowlisting egress
For the full set of hosts Dockli reaches — Microsoft 365, the AI gateway, the licensing service, and the diagnostics portal — see Endpoints to allowlist.
Retention and removal
- Sign-out (active account) removes that account from the token cache and the added-accounts list.
- Sign out of everything / clear cache removes all accounts from the MSAL cache and clears the added-accounts list.
- Uninstall removes Dockli’s entire local data folder — including the encrypted token cache, accounts, settings, favorites, and preferences — and releases the user’s licensed seat back to the organization automatically.
Because file content was never copied out of Microsoft 365 in the first place, uninstalling Dockli touches none of your documents — they remain exactly where they always were, in your tenant.