Dockli’s data-handling posture is simple to state: your file content stays in Microsoft 365, and the only data Dockli persists lives on the local device — a small set of state files, with anything sensitive encrypted. Nothing about your files is copied to a Dockli server.
File content stays in your tenant
Dockli reads and displays your SharePoint, Teams, OneDrive, and Hub Site files live through Microsoft Graph. It does not copy file content to any Dockli-operated or third-party server, and there is no cloud service in the middle that holds your files or your token. When you open, preview, edit metadata, or restore a version, that operation goes straight to Microsoft 365 as the signed-in user.
Because access is delegated (see Permissions and scopes), the data boundary is your tenant’s own permission model. Your data stays in your Microsoft 365 tenant.
Cross-tenant copy is still tenant-to-tenant
When a user copies a file between two of their own signed-in accounts, Dockli streams the bytes from the source tenant to the destination tenant using each account’s own delegated token. The content moves M365-to-M365 on the user’s behalf — it is not staged on a Dockli server.
What Dockli stores locally
All local state lives under %LocalAppData%\Dockli — specifically the Data\ subfolder, which is kept separate from the app’s install directory so it survives updates. The complete list:
| File | Contents | Sensitive? |
|---|---|---|
Data\msal_cache.bin | The MSAL token cache (access + refresh tokens for the signed-in accounts). | Yes — DPAPI-encrypted (CurrentUser scope). |
Data\accounts.json | The list of account identifiers the user added to Dockli, and which is active. | Identifiers only, no secrets. |
Data\settings.json | Small app state, including the signed-in identity (tenant id, user object id, email) used for telemetry and seat release. | Identity metadata, no file content, no tokens. |
Data\favorites-<account>.json | The user’s favorite locations, one file per account. | Names/paths of favorited items only. |
| Folder-color preferences | Per-folder color choices set in the UI. | Preferences only, no content. |
The token cache — the only file holding anything sensitive — is encrypted at rest with the Windows Data Protection API, tied to the current Windows user, so it can’t be read by another user or lifted onto another machine. See Authentication and tokens.
No file content is cached to disk
None of the local files contain your document contents. Dockli persists tokens, an accounts list, settings, favorites, and preferences — never the files themselves. File bytes are streamed from Graph as needed and rendered in the UI.
AI attachment handling
When a user attaches a document to an Ask Dockli conversation, Dockli extracts its text and holds that extracted text in memory only, in a store that evicts entries after a short time-to-live (about three hours) and by count. Raw file bytes are not sent to the AI model, and the extracted text is not written to disk. Full detail is in AI security.
Diagnostics and telemetry
Dockli emits best-effort, non-content diagnostic events to help operate the product — sign-in, startup, shutdown, warnings, errors, and crashes. These are posted to the Dockli portal at portal.tinytugboat.com.
What a diagnostic event contains:
- The event type (for example sign-in, warning, error, crash).
- The message and, for errors and crashes, the exception stack trace.
- Identity metadata: the Microsoft tenant id, the user object id, and the user email, read from the local
settings.json. - A timestamp.
What it never contains:
- No file content, file names of your documents, or folder contents.
- No access tokens or credentials.
Two properties matter for security review:
- Failure is swallowed. Telemetry is fire-and-forget; if the portal is slow or unreachable, the failure is logged locally and never surfaces to the user or blocks the app. An outage on the diagnostics endpoint cannot turn into a sign-in failure.
- No third-party analytics. The Dockli app ships no third-party analytics or crash SDKs — there is no Application Insights, Sentry, or similar on your device. Diagnostics go only to the first-party portal.
Allowlisting egress
For the full set of hosts Dockli reaches — Microsoft 365, the AI gateway, the licensing service, and the diagnostics portal — see Endpoints to allowlist.
Usage analytics
To run and support Dockli, Tiny Tugboat keeps content-free usage analytics on its own Azure services. Nothing extra is collected on your device: this is derived from calls Dockli already makes to the licensing service and the AI gateway.
| What | Recorded | Never recorded | Where & how long |
|---|---|---|---|
| Activity — from the licence check Dockli makes at sign-in and roughly hourly while it’s open | Tenant id, user object id and email; which days, and which hours of the day, the user was active; when their seat was claimed, released or re-claimed. | What the user did in Dockli, files, folders, searches. | Dockli licensing database (Azure SQL, Sweden Central) — about 13 months. |
| AI usage (Spark) — recorded by the AI gateway on each Ask Dockli request | Tenant id and user object id; the type of request (a new prompt, an action step, or an email-writing assist); the names of the actions the assistant took (for example SearchWorkspace or RenameItem); token counts and model. | Prompt text, AI responses, document contents, file or folder names, email content. | Azure Application Insights (West Europe) — 90 days. Daily totals (counts, action categories, tokens, cost) are copied to the licensing database and kept about 13 months. |
- Who can see it: only authorised Tiny Tugboat staff, in Dockli’s internal licensing console. It isn’t shared with other customers, sold, or used for advertising.
- What it’s used for: operating and supporting the service, understanding adoption, managing capacity and AI cost, and improving Dockli.
- AI conversations stay on the device. The prompt and response text you see in Ask Dockli is stored only locally (see Chat history) — the analytics above record only that a request happened and which actions ran.
- Deletion: email support@dockli.io to have usage data for your organization or a specific user removed.
Retention and removal
- Sign-out (active account) removes that account from the token cache and the added-accounts list.
- Sign out of everything / clear cache removes all accounts from the MSAL cache and clears the added-accounts list.
- Uninstall removes Dockli’s entire local data folder — including the encrypted token cache, accounts, settings, favorites, and preferences — and releases the user’s licensed seat back to the organization automatically.
- Usage analytics (see above) age out automatically — about 13 months for activity and daily AI totals, 90 days for per-request AI usage records — or are deleted on request.
Because file content was never copied out of Microsoft 365 in the first place, uninstalling Dockli touches none of your documents — they remain exactly where they always were, in your tenant.