All Guides

Guides

Practical guides for getting the most out of doconvoy.

Privacy & zero-knowledge8

Encryption

Zero-Knowledge vs End-to-End Encryption: What's the Difference?

End-to-end encryption is about communication: only the sender and recipient can read a message, not anyone in between. Zero-knowledge is about storage and the provider: the company holding your data can't read it, because it never has the keys. They overlap, and one service can be both.

Zero-knowledge

Zero-Knowledge Encryption, Explained Without the Jargon

Zero-knowledge encryption means your data is encrypted on your own device before it's uploaded, and the key never reaches the provider. So the company hosting it has zero knowledge of what's inside and couldn't read it if it wanted to. Here's what that means in plain terms, and how to tell if it's real.

Privacy

Your SaaS Shouldn't Know Your Secrets

Most software could read everything you put into it. It just promises not to. A better design removes the question entirely: build the app so it's technically unable to read your data, and trust stops being something you have to extend on faith.

Zero-knowledge

What Zero-Knowledge Encryption Protects, and What It Doesn't

Zero-knowledge encryption protects the content of your data from the provider: they store it but can't read it. It doesn't hide metadata, rescue a hacked device, or make you compliant on its own. It's a strong tool for one job, not a force field. Here's the honest line.

Privacy

What Does "Privacy-First" Actually Mean?

Every tool claims to be privacy-first, so the label tells you nothing on its own. In practice it should mean privacy is the main design constraint: collect as little as possible, hold it where you can't read it, and protect people by default. Here are four questions that tell real from marketing.

Privacy

The Best Way to Protect Sensitive Data Is Not to Have It

The safest data is the data you never collected. The next safest is data you hold in a form you can't read. Most breaches expose information a company had no real reason to keep. Here's the privacy-by-design idea behind that, in plain terms.

Privacy

Privacy by Default vs Privacy by Design: What's the Difference?

Privacy by design means building data protection into a product from the start. Privacy by default means the most protective setting is the one you get without changing anything. Design is the philosophy; default is one of the outcomes it has to produce. Both are duties under GDPR Article 25.

Privacy

Client Confidentiality for Translators: Why Trust Is the Human Edge Against AI

As machine translation absorbs routine work, the human, certified end of the market competes on trust, and confidentiality is a large part of it. Here's what confidential document handling means in practice: NDAs, end-to-end encryption, GDPR, and clear deletion.

Security & access13

Security

Is It Safe to Send Your Passport Over Email or WhatsApp?

Not really. Email isn't encrypted end to end, so a passport copy sits in two inboxes and their backups with no expiry. WhatsApp encrypts messages in transit, but the image saves to the recipient's phone and photo cloud, where it can be screenshotted or forwarded. Ask for an encrypted upload link that expires instead.

Security

What Access Does a Web Developer Need From a Client?

A web developer typically needs the domain registrar, hosting, database, and CMS admin, plus brand assets and content. Here's the full checklist, which items to delegate rather than collect, and how to hand the rest over securely.

Security

Is It Safe to Send Documents for Translation by Email?

No. Emailing a birth certificate, contract, or medical record for translation leaves a copy in inboxes and backups neither you nor the translator controls, with no expiry and no way to pull it back. Use an end-to-end encrypted upload link instead.

Security

How to Rotate and Expire Client API Keys

Rotate the API keys and service-account secrets you hold at project boundaries and after any personnel change, not on a nervous whim. Collecting keys through requests that expire turns each re-collection into a built-in rotation prompt.

Security

How to Collect Website Logins From Clients Securely

Collect a client's hosting, domain, and CMS logins through an end-to-end encrypted request they open without an account, not a Slack DM or a shared doc. Here's the workflow, and which access to delegate instead of collecting.

Security

How to Collect API Keys From Clients Securely

Collect a client's API keys and tokens through an end-to-end encrypted request, one structured intake for every key the automation needs, not a Slack DM or a spreadsheet. Here's the workflow and how to keep the keys straight across projects.

Security

How Should Clients Share Hosting and Domain Access With an Agency?

Add the agency as a user where you can, and for hosting, registrar, and database logins that have no user model, send them through an end-to-end encrypted link, never by email or chat. Here's how to decide, access by access.

Security

API Keys vs OAuth: How Should an Automation Agency Get Client Access?

Use OAuth where the service offers it, it gives scoped, revocable access without handling a raw secret. Where only a raw API key exists, collect it through an end-to-end encrypted request. Here's how to decide, and why it matters for the keys you hold.

Team security

Sharing Client Credentials Across an Agency Team

Scope access by client and role so each person sees only the accounts they work on, share individual secrets through encrypted expiring links, keep a record of who accessed what, and revoke and rotate when someone leaves. For standing team logins, use a password manager.

Security

Is It Safe to Send Passwords Over Email or Slack?

No. Email and Slack were built for conversation, not secrets. A password sent in either sits in message history you don't control, where it can be exported, searched, or forwarded. Use an encrypted expiring link or a password manager instead.

Access control

How to Make Every External Link Your Team Sends Meet the Same Security Standard

Don't leave link security to whoever creates the link. Set a default standard for external links, who must authenticate, whether a passcode is required, and when it expires, and enforce it so every link starts protected instead of relying on someone to remember.

Access control

How to Revoke Access After You've Already Shared a Link or Credential

You can't un-send a message, but you can revoke the access it pointed to. Kill the whole link, cut off a single recipient, rotate a leaked passcode, and rotate the credential itself if the secret was exposed. Make revocation the last step of every project.

Credentials

How to Ask Clients for Passwords Securely

The safest way to get access is often not to collect a password at all. Ask clients to grant delegated access where they can, and when a secret has to be shared, use an encrypted expiring link or a password manager, never email or chat.

Collecting from clients5

Document collection

How to Receive Documents for Translation Securely

The safe way to receive a document for translation is an end-to-end encrypted upload link the client opens without an account, encrypted in their browser and set to expire after the job. Here's the workflow, and why it matters most for certified and legal work.

Client intake

How to Standardize Client Intake With a Reusable Request Template

Build the request once and reuse it for every client of that type. Define the set of documents or fields you always need as a template, then create each client's request from it, with the protection and branding set once at the project level.

Document collection

How to Collect Documents From Clients Without Email Attachments

Send clients one secure request instead of chasing attachments: a checklist of exactly the documents you need, uploaded through an encrypted page with no account to create, each file tied to its request, with reminders chasing anything still missing.

Freelancing

How to Look Professional When You Collect Files and Logins From Clients as a Freelancer

As a freelancer, how you ask for sensitive things is the trust signal. Skip WhatsApp and email. Send one clean, branded page that carries your name, lets the client upload without an account, and visibly protects what they send.

Trust & branding

How to Give Clients a Branded Handoff That Builds Trust

The page where a client hands over a passport or a password should look like your service, not a generic tool. Put your logo, colors, and your own domain on it, and for client work, show the client's logo alongside yours.

For your profession1

Law firms

How Should a Law Firm Collect a Client's ID and Documents?

Not by email or WhatsApp. A client's ID is confidential from the first exchange, and for regulated due diligence an unverified emailed photo doesn't meet the standard. Collect onboarding documents through a secure, encrypted link, isolated per matter, then run your identity verification and keep the records you're required to keep.