Your tenant. Your rules. Zero tokens in the browser.
Dockli is built to sit inside your Microsoft 365 estate without ever becoming a new place for data to leak. Here’s exactly how it authenticates, stores and moves nothing it shouldn’t.
Four guarantees, by architecture.
MSAL + WAM broker
Sign-in uses Microsoft’s native Windows broker — no passwords touch Dockli.
Graph proxied server-side
The UI never holds an access token; every call is brokered locally.
DPAPI-encrypted cache
Tokens are encrypted at rest with Windows Data Protection.
Loopback only
The local host binds to localhost — nothing is exposed to the network.
How every layer is secured.
Authentication — MSAL + Windows WAM
Sign-in runs through the Microsoft Authentication Library and the native Windows WAM broker. Credentials are handled by Windows itself — no passwords ever touch Dockli. Users get the same trusted sign-in experience as every other Microsoft 365 app on their machine.
Token handling — Graph proxied server-side
A local, headless ASP.NET Core backend proxies every Microsoft Graph call. The WebView2 browser UI never holds or sees an access token — it talks only to the local API, which brokers requests on its behalf. There is no token to exfiltrate from the front end.
Encryption at rest — DPAPI
The token cache is encrypted at rest using the Windows Data Protection API (DPAPI), tied to the signed-in user account. Cached credentials are readable only by that user on that machine.
Network posture — loopback only
The local Kestrel host binds exclusively to localhost (loopback). Nothing Dockli runs is exposed to the network or reachable from another device — the API surface is available only to the local UI.
Data residency & permission scoping
Dockli only ever shows — and only ever acts on — files the signed-in user can already access in Microsoft 365. It rides on your existing permissions and never widens them. No data leaves your tenant’s permission boundary.
Admin consent, on your terms
Deployment is gated by tenant-wide admin consent. A Global Administrator approves Dockli’s Graph permissions once, from any browser, via an emailed link — so nothing runs in your tenant until IT explicitly says yes.
Your token never reaches the screen.
Every Microsoft 365 request follows the same path — and the access token stays server-side the whole way.
- 1
Sign in
Windows’ native account broker (WAM) authenticates you. No password touches Dockli.
- 2
Token cached
The token is stored locally, encrypted at rest with DPAPI, tied to your Windows user.
- 3
UI asks locally
The in-Explorer interface calls only a loopback service on your machine — never Graph directly.
- 4
Service calls Graph
The local service attaches the token server-side and calls Microsoft Graph as you.
- 5
Results render
Files and metadata come back to the UI — which never saw a token to begin with.
The local service binds to localhost only and is never reachable from the network. There is no access token in the browser layer to steal, phish or exfiltrate.
Only the permissions it needs — all delegated.
Every permission Dockli requests is a delegated Microsoft Graph scope: Dockli only ever acts as the signed-in user, inside that user’s existing access.
| Permission | Why Dockli needs it |
|---|---|
Sites.Read.All | Discover and browse the SharePoint sites and Hub Sites you can access. |
Files.Read.All / Files.ReadWrite.All | Read files and — where you have edit rights — update metadata and restore versions. |
User.Read | Identify the signed-in user and show profile details. |
Team.ReadBasic.All | List the teams you’ve joined so their SharePoint content appears. |
Calendars.Read · Mail.Read · Tasks.Read | Power at-a-glance productivity views — read-only, scoped to your own account. |
Additional scopes (sending email or Teams messages, people search) are requested only when you first use that feature — never up front. See Permissions & scopes for the complete list.
What Dockli never does.
Never copies your files to outside servers — content stays in Microsoft 365.
Never sees or stores your password — Windows handles the credential exchange.
Never exposes an access token to the browser UI.
Never opens an inbound port or exposes anything to the network.
Never widens your access — it rides on your existing Microsoft 365 permissions.
Never uses your content to train foundation AI models.
Never ships a third-party analytics or ad SDK in the app.
Never runs in your tenant without explicit admin consent.
The AI never holds the key — or oversteps your access.
On the Spark plan, Ask Dockli runs on Azure OpenAI reached through an Azure API Management gateway. Your device never holds the model key: the gateway validates a signed licence entitlement and injects the key server-side, so the AI is only ever available to a licensed seat — and stays inside your permission boundary.
Read the AI security docs →-
Key never on the device
The Azure OpenAI key is injected by the gateway, not stored in the app — a patched client still can’t reach the model.
-
Gated by your licence
Every AI call carries a signed entitlement token. No active seat, no answer — the gateway fails closed.
-
Only text, only your files
Attachments are read as text server-side; raw files and your Graph token never reach the model. Nothing trains foundation models.
Your data stays in your tenant.
Where content lives
File contents are read and displayed live through Microsoft Graph and are never copied to Dockli servers. If you uninstall Dockli, your files are exactly where they always were — in Microsoft 365.
What’s stored on the device
Only your DPAPI-encrypted sign-in cache and a small local settings/favorites store, under your Windows profile. All of it is removed when you sign out or uninstall.
Diagnostics
Dockli sends limited, non-content diagnostic events (sign-in, start-up, errors) to keep the app reliable. Your file contents are never part of them.
Read it in full
The complete data-handling breakdown — every file stored, every scope, every endpoint — is in the data handling and security architecture docs.
Verified publisher, least-privilege by design.
Dockli is published by Tiny Tugboat with a publisher-verified domain in Microsoft Entra, so the consent screen your admins see clearly identifies who’s asking. Purchasing is simple too — Dockli is licensed per seat, bought directly with our team on a purchase order.
-
Publisher-verified domain
Dockli’s Entra app carries a verified-publisher domain — admins see a trusted, attributable consent prompt.
-
Buy directly, per seat
Procurement is handled directly with the Dockli team on a purchase order — license by seat as your team grows.
-
Least-privilege Graph scopes
Dockli requests only the Graph permissions it needs to do its job — nothing broader.
Walk your security team through it.
Book a demo and we’ll cover the architecture end to end, question by question.