Dokebi Privacy

Privacy Policy

Effective: September 2, 2026 · Controller: Dokebi · Region: Azure koreacentral (South Korea)

Dokebi is an incident management and analysis workbench. This policy explains what we collect, why, where it is stored, and how to request deletion — including for the Slack App reviewed via dokebi.org/privacy.

Summary

  • We store only what incident work requires: normalized events (timestamp, category, title, detail, host, payload), attachment metadata + OCR text/IOCs, and workspace-scoped OAuth tokens.
  • Raw collector ZIPs are parsed in memory in stateless containers and not persisted to Blob or disk.
  • Slack data is limited to the scopes you grant (least privilege). We do not read direct messages unless the bot is explicitly invited to a channel.
  • Contact support@dokebi.org for access or deletion.

1. Data we collect

Slack App data (when installed)

  • Workspace identifiers: team_id, team name, installer user_id
  • OAuth tokens: bot token (chat:write etc.), user token if granted
  • Channel context where bot is invited: channel_id, message timestamps, slash command payloads
  • We do not collect Slack billing, enterprise grid org data, or DM history outside invited channels.

Forensic & incident data

  • Collector artifacts parsed to analysis_events (PROCESS / NETWORK / FILE / AUTH)
  • Incident attachments metadata (SHA256, size, MIME) → incident_attachments
  • OCR results / IOCs → attachment_ocr_jobs (in-container RapidOCR)
  • Case, timeline, and analyst actions tied to your tenant/slug

Platform & account data

  • Login identifiers via configured IdP (OIDC), tenant membership
  • Operational logs for security (Log Analytics Workspace) — access and error events only
  • No advertising identifiers or cross-site tracking.

What we do not collect

  • Raw collector ZIPs after parse (zero file-share overhead by design)
  • Slack messages from channels where the app is not a member
  • Unnecessary Slack scopes — we request minimal scopes and justify each in App Directory submission

2. Where data is stored

  • Azure PostgreSQL Flexible Server (dokebi-db-c7ygr4vjrni5e.postgres.database.azure.com, Standard_B1ms, koreacentral) — structured events, cases, tenants, OAuth tokens (encrypted at rest).
  • Azure Blob Storage (attachments container, Standard_LRS) — incident/messenger attachments + OCR outputs only. Injected via AZURE_STORAGE_ACCOUNT / KEY env.
  • Azure Container Apps Environment (dokebi-env-c7ygr4vjrni5e) — stateless Next.js + Python runner sidecar. Runner enforces RUNBOOK_LIMIT_FSIZE_MB=8 and has no external network or secrets.
  • Log Analytics Workspace (dokebi-logs-c7ygr4vjrni5e) — container logs only.
  • Local development only: file SQLite at data/dokebi-local.sqlite when DATABASE_URL is unset. Production uses PostgreSQL exclusively.

3. How we use data

  • To provide incident management and analysis: timelines, case management, file/IOC search, and Slack ChatOps (runbooks/playbooks).
  • To authenticate Slack OAuth (oauth.v2.access) and deliver slash commands / events to the linked channel.
  • To secure the platform: tamper-evident audit ledger, rate limiting, and abuse prevention.
  • We do not sell data, serve ads, or train third-party models on your content.

4. Retention & deletion

  • Cases, events, attachments, and OCR jobs are retained until the workspace admin deletes the case or requests workspace deletion.
  • Slack OAuth tokens are deleted within 7 days of app removal or verified deletion request.
  • Blob attachments are removed when the linked case is deleted; OCR/IOC derived data is removed with it.
  • Backups: Azure PostgreSQL retains automated backups per Flexible Server policy (geographically within the region). Deleted data is not restored after the retention window.
  • To request deletion: email support@dokebi.org with workspace domain + team_id. We confirm completion by email.

5. Your rights & choices

Workspace admins control which channels the app can access (invite/remove bot), which Slack scopes are granted at install time, and which forensic artifacts are uploaded. Individual users can request access, correction, or deletion via their workspace admin or support@dokebi.org. We respond within 1–2 business days (KST).

6. Security

  • Encryption in transit (TLS) and at rest (Azure PostgreSQL + Blob). Managed certificates for dokebi.org via Azure Managed Certificates.
  • Tenant isolation by slug; secrets are injected via Container Apps secrets, not bundled in images.
  • Stateless containers scale on ACA serverless; the Python runner sandbox has no external network and enforces an 8 MB file guard.

Contact & updates

Questions or complaints: support@dokebi.org · For Slack App review correspondence use the same address. We link this policy as https://dokebi.org/privacy in Slack App Directory.

We will update the effective date above when this policy changes and note material changes on /support.

This policy does not replace your organization’s own retention or handling obligations for forensic evidence. Manage evidence according to your internal legal and compliance requirements.