Your clients' files stay on your site

Files never leave your site

Uploads go straight from the client's browser to your WordPress site. They are not sent to us or to any third-party storage service.

Private storage

• Files are saved in a private folder outside the public media library, with direct web access blocked on Apache and IIS. On Nginx, the Setup screen checks the folder and shows the one rule to add if it is reachable.
• Files get random names on disk and are only served to logged-in staff with access to that request.
• File types are checked by content, not just by extension, against the types you allow for each item.

Private links for clients

• Each request has its own long, random link. It is stored hashed for lookups and encrypted, never in plain text.
• Links expire on the date you choose. You can extend a link, issue a new one or revoke it at any time.
• Clients only ever see their own checklist.

Who on your team can see what

• Administrators and the DocsInOrder Staff role have access. You can also switch access on for individual users on their profile.
• Customer and subscriber accounts (including WooCommerce customers) can never be given access, even by mistake.
• With Pro, Employees only see the requests assigned to them or that they created.

Data we receive

None of your clients' data. The plugin can optionally send basic, non-client usage data (such as WordPress and PHP versions) through Freemius, only if you opt in on the Setup screen. It is off by default. See our privacy policy.

What you're responsible for

• Keep WordPress, your theme and plugins updated, and use HTTPS (the setup checklist checks this).
• Back up your site, including the DocsInOrder storage folder.
• Decide how long to keep client files, and delete requests you no longer need.

Found a security issue? Email support@getdocsinorder.com.