Security for docs sites and support tickets
Revdoku publishes docs sites and keeps their files and their support tickets. This page tells where your data is, who can open it, and what Revdoku records.
Infrastructure
| Area | Details |
|---|---|
| Data location | United States. Servers, the database and email run on Amazon Web Services (AWS) in Northern Virginia. Files, email messages, published sites and backups are in Cloudflare R2 in the eastern United States. |
| Encryption | AES-256 at rest. TLS in transit. |
| AI features | Ask AI, the AI filter and the support agent run in the same region as your data. The AI provider does not keep the data. |
| Model training | We do not use your docs, email or files to train general-purpose AI models. |
| Providers | AWS for servers, the database and email. Cloudflare for file storage, published sites, network and bot protection. Polar for payments. |
The privacy policy gives more details.
GitHub access
Revdoku connects to GitHub through the Revdoku GitHub App. It reads and writes your repository through the GitHub API and keeps no clone of it.
| Permission | What Revdoku does with it |
|---|---|
| Contents: read and write | Copies the docs files, and sends the edits that you make in Revdoku as commits. |
| Metadata: read | Reads basic facts about the repository, such as its name. GitHub gives this permission to every app. |
| Commit statuses: read and write | Shows the “Revdoku” status with the link to the site or the preview on each commit. |
| Pull requests: read and write | Opens a pull request with your edits, and merges it when you click Merge and publish. |
| Members: read (organization) | Makes sure that the person who connects an organization is its admin. |
The app has no Administration permission. Revdoku never creates, deletes or configures repositories.
Access to docs sites
- Each docs site is public. A setting hides a site from search engines. A preview of a branch is hidden from search engines and lasts 24 hours.
- In the API console of a public site, requests go through the site’s own proxy only to the servers that your OpenAPI file lists. The proxy removes cookies and logs nothing.
- Every published site must follow the Website Publishing Policy.
Security controls
| Control | Details |
|---|---|
| People | Each member has a role: Reviewer (view files), Editor (edit files) or Administrator (manage buckets, settings and members). |
| AI apps and API keys | Give each connection access to selected buckets only, with read only, read & write or full access. |
| Two-factor authentication | Turn it on for the people on your account. |
| Activity logs | Each action by a person or an AI app goes into the log, with its connection and its reason. |
| Version history | See the changes to a file. Restore an earlier version. |
| Support tickets | Revdoku scans incoming email for viruses and spam. The AI filter checks each new message: email, a message left on the site or page feedback. It labels suspected phishing and prompt injection as Junk, and AI agents and apps get no content from Junk messages. The filter can miss an attack. |
Give each AI app only the access that it needs. Use a separate bucket for docs that need different permissions.
Transparency and audit logs
The dashboard shows each support ticket and each action that a person or a connected AI app takes. Use these views to see what your AI apps read and changed.
The activity log shows the actions of each connection, with the reason for each action. You can filter it by connection: the dashboard, the CLI or an MCP connection. An AI app that reads a ticket through the API, the CLI or MCP adds an entry to the same log.
Report a security issue
Send an email to support@revdoku.com with the steps to reproduce the issue. Send other security questions to the same address.
A docs portal with Ask AI
and support tickets
Connect a repository, or describe your product to start. Each docs site has search, Ask AI, an API console, an MCP server and support tickets.
- Publishes from GitHub on every push
- Works with Mintlify repositories
- API console from your OpenAPI file
- MCP server and llms.txt for AI agents
- Ask AI and support tickets
- Analytics for people and AI agents