Meet ONLYOFFICE Docs 10.0 modular apps and AI tools, 50+ new features, 1,000 bug fixes, 35 fixed vulnerabilities, and more
Meet ONLYOFFICE Docs 10.0
Enterprise
Pricing
Log in / Sign up
+371 633 998 67
Log in / Sign up
ONLYOFFICE Docs

Security first, by design

ONLYOFFICE is built with security at its core. Your data stays under your control, your documents are protected with multiple layers of security, and your teams get access only to what they are allowed to see and do.

From open-source code and granular permissions to encryption, audit logs, and deployment flexibility, ONLYOFFICE gives organizations the tools they need to work securely in any environment.

Book a free demo

Built for control, transparency, and compliance

Open source transparency

The ONLYOFFICE source code is publicly available on GitHub. Your internal security team, third-party auditors, and the global open-source community can inspect it at any time.

View on Github

Compliance support

ONLYOFFICE products are designed to meet the stringent requirements of global data protection and healthcare privacy regulations.

  • GDPR Compliant

    ONLYOFFICE products are fully compliant with the General Data Protection Regulation, giving EU organizations the controls they need.

  • HIPAA Supported

    ONLYOFFICE supports the technical safeguards required by HIPAA, making it a viable solution for healthcare organizations.

Choose where your data lives

Data location matters, especially for regulated industries and organizations with strict residency requirements. ONLYOFFICE gives you full control over where your data is stored.

  • Self-hosted deployment

    Host ONLYOFFICE on your own servers and keep documents, user data, metadata, and audit logs inside your infrastructure. ONLYOFFICE has no access to your data, and nothing leaves your environment unless you configure it to do so.

  • Third-party storage integration

    Connect ONLYOFFICE to services your company uses. Your data remains with the storage provider you choose.

Document security in ONLYOFFICE Docs

ONLYOFFICE Docs includes multiple layers of protection for editing, sharing, and collaboration.

  • Secure access

    JWT protection secures document editing sessions from unauthorized access and token manipulation. Tokens are included during editor initialization and inter-service communication, so users can perform only the actions they are explicitly authorized to perform.

  • Granular permissions

    Set permissions for each document independently, including:

    • View only
    • Comment only
    • Review with tracked changes
    • Edit
    • Fill forms

    You can also restrict downloading, printing, and copying by user.

  • Password protection

    • Protect individual documents with passwords using AES-256 encryption
    • Encrypt all traffic in transit with HTTPS / TLS

  • Spreadsheet protection

    Protect sensitive spreadsheet data with:

    • Locked workbooks and sheets
    • Protected cell ranges
    • Hidden formulas for unauthorized users

  • Digital signatures

    Verify document integrity and authenticity with digital signatures. Signature requests can be sent to one or multiple parties, with configurable appearance and support for multiple signature types for PDF contracts.

  • Version history

    Track every change with timestamps and author attribution. Restore previous versions at any time.

Workspace protection in ONLYOFFICE

ONLYOFFICE Apps helps teams collaborate securely while giving administrators fine-grained control over access, sharing, and activity tracking.

Role-based access control

Assign one of four permission levels within each room:

  • Room ManagerManage access
  • Content CreatorManage files and folders
  • EditorFull editing access
  • ViewerRead only access

Permissions can be adjusted at any time by the room owner or administrator.

Secure external sharing

Invite external users by link, even without an account. You can:

  • Set permission levels
  • Add password protection
  • Define expiration dates
  • Restrict downloading, printing, and copying

Watermarks

Apply document metadata and author information automatically as watermarks when sharing documents externally

Audit trail and activity logging

Track who accessed a file, when they accessed it, from which device, and what action they performed. Audit reports can be generated and exported, including in Virtual Data Rooms for compliance workflows.

Go to dateExport history
  • File updatedAlex N · Chrome · macOS10:32 AM
  • File createdMaria K · App · Windows11:28 PM
  • Room createdElyzabeth R · Firefox12:32 PM
  • User addedAdmin · Chrome · Linux01:41 PM

Encryption at rest

Documents stored in ONLYOFFICE are encrypted at rest using AES-256-CBC with HMAC-SHA256 integrity verification.

  • AES-256-CBC
  • HMAC-SHA256

Private Rooms

End-to-end encryption for Private Rooms is coming soon, using AES-256 with asymmetric key sharing for highly sensitive files.

  • AES-256

Automated backups

Back up your data automatically to the storage provider of your choice, including Dropbox, Box, Google Drive, OneDrive, AWS S3, Google Cloud Storage, and others. Backup frequency and retention settings are configurable.

  • Dropbox
  • AWS S3
  • Google Drive
  • Box
  • Google Cloud Storage
  • OneDrive

Strong authentication and identity controls

ONLYOFFICE gives administrators the tools to secure user authentication and control access across the platform.

Two-factor authentication

Support for authenticator apps including:

  • Google Authenticator
  • Authy
  • Other compatible TOTP apps

Single Sign-On

Integrate with identity providers through SAML 2.0, including:

  • Shibboleth
  • OneLogin
  • AD FS

Additional providers can be connected through standard SAML configuration.

Authentication policies

Administrators can configure:

  • Trusted mail domains
  • Password complexity rules
  • Cookie lifetime and automatic session expiry
  • IP-based access restrictions
  • Login attempt limits to protect against brute-force attacks
  • Full login history, including failed attempts and session terminations

AI security: assistants, agents, and MCP

  • Flexibility with AI model integration

    ONLYOFFICE allows connecting with external, local, or open source AI models using your API keys.

  • Enhanced security and access control

    AI agents manage files and permissions using strict role-based controls.

Bug Bounty Program

ONLYOFFICE operates a public Bug Bounty Program on HackerOne, inviting security researchers and independent experts to test products and report vulnerabilities for fair compensation. Contact us at marketing@onlyoffice.com to join it.

The ONLYOFFICE community forum also provides a space to report issues, share feedback, and discuss product security and improvements.

Contact usCommunity forum

Frequently Asked Questions