Security & Trust

How we protect your data and ensure platform security

End-to-End Encryption

All data is encrypted in transit and at rest

Secure Infrastructure

Enterprise-grade cloud security

Privacy by Design

Your data is never used to train our models

Data Protection & Encryption

Encryption Standards

Data in Transit
TLS 1.3
Data at Rest
AES-256
Database Encryption
AES-256
Backup Encryption
AES-256

Data Handling

  • Uploaded files are processed temporarily and automatically deleted after analysis
  • Analysis results are encrypted and stored securely
  • No data is used to train AI models or shared with other customers
  • We don't copy or store records from your Salesforce org. If you connect Salesforce, we keep only the sign-in credentials needed to keep that connection active
  • Data is geographically distributed with automatic failover
Infrastructure Security

Cloud Security

Vercel (Hosting)

  • SOC 2 Type II certified
  • ISO 27001 compliant
  • DDoS protection and WAF
  • Global CDN with edge security

Supabase (Database)

  • SOC 2 Type II certified
  • Row Level Security (RLS)
  • Automated backups and point-in-time recovery
  • Network isolation and VPC

Stripe (Payments)

  • PCI DSS Level 1 certified
  • SOC 1 Type II and SOC 2 Type II
  • ISO 27001 and ISO 27018 certified
  • Advanced fraud detection

Network Security

  • Web Application Firewall (WAF) protection
  • DDoS mitigation and rate limiting
  • Intrusion detection and prevention systems
  • Regular security scanning and vulnerability assessments
Access Control & Authentication

User Authentication

Password Requirements
Strong Policy
Two-Factor Authentication
Available
Session Management
Secure
OAuth Integration
Coming Soon

Internal Access Controls

  • Principle of least privilege for all team members
  • Multi-factor authentication required for all admin access
  • Regular access reviews and deprovisioning
  • Audit logging for all administrative actions
Compliance Journey

Here is exactly where Daytatech.ai stands today. Daytatech.ai has not yet completed an independent compliance audit. The platform runs on infrastructure providers that already hold their own certifications, and we are building our own program on top of that.

Certified today: our infrastructure providers

Vercel

Hosting

SOC 2 Type II, ISO 27001

Supabase

Database

SOC 2 Type II

Stripe

Payments

PCI DSS Level 1, SOC 2 Type II

These certifications belong to each provider and cover the infrastructure they run. They are not a certification of Daytatech.ai itself.

In progress: Daytatech.ai's own program

  • SOC 2 Type II

    Preparing for audit

    We are putting security controls in place and tracking them with Vanta.

  • GDPR

    Implementing

    We are adding data access, export and deletion requests, plus data processing terms.

  • ISO 27001

    Aligning policies

    We are mapping our security policies to the ISO 27001 standard.

  • HIPAA

    Not yet supported

    Please don't upload protected health information (PHI) until this is complete.

Need security details for a vendor review? Email security@daytatech.ai and we'll send our current security questionnaire answers and policies.

Security Monitoring & Incident Response

24/7 Monitoring

  • Real-time security event monitoring and alerting
  • Automated threat detection and response
  • Regular security scans and vulnerability assessments
  • Performance and availability monitoring

Incident Response

Less than 1 hour
Detection Time
Less than 4 hours
Response Time
Less than 72 hours
Notification Time

Security Team

  • Dedicated security professionals with industry certifications
  • Regular security training and awareness programs
  • Collaboration with external security researchers
  • Participation in responsible disclosure programs
Data Retention & Secure Deletion
Data TypeRetention PeriodDeletion Method
Uploaded FilesImmediately after processingCryptographic erasure
Analysis ResultsDuration of subscriptionSecure deletion
Account DataUntil account deletionMulti-pass overwrite
Billing Records7 years (legal requirement)Secure archival then deletion
Audit Logs2 yearsAutomated purging
Security Best Practices for Users

Account Security

  • Use a strong, unique password for your DaytaBrain account
  • Enable two-factor authentication when available
  • Never share your login credentials
  • Log out when using shared devices

Data Security

  • Only upload data you have authorization to process
  • Review and understand data classification policies
  • Report any suspicious activity immediately
  • Regularly review access permissions for your team

Security Questions?

If you have questions about our security practices or need to report a security concern, please contact us.

security@daytatech.ai
DaytaBrain