Security
Your data. Your control.
Enterprise-grade infrastructure, provisioned for every company, priced for smaller businesses. An honest look at how we protect your data today and what we're building toward.
Data Isolation
Per-company isolation
Every company gets its own isolated infrastructure. Storage is separated with per-tenant key prefixes and optional bring-your-own-key encryption. There is no cross-tenant data access.
David is hostable in the UK, EU, or US, so you choose where your data lives.
Infrastructure
What's in place today
Hostable in UK, EU, or US regions
Bulk storage with optional bring-your-own-key encryption
Per-company infrastructure isolation
Role-based access, management, and onboarding flows
Encrypted in transit via HTTPS across all services
AI Providers
Vetted providers, clear boundaries
David uses the major AI providers you've heard of, including Anthropic, OpenAI, and Google, alongside specialist providers whose models work better for specific agentic tasks. We've done the hard work of evaluating which model works best for what, and vetting each provider's data policies, so you don't have to.
No vendor lock-in: Unlike assistants from Anthropic, Google, or OpenAI that only use their own models, David is provider-agnostic. As better models emerge (including open-source ones), David adopts them, passing on improvements in capability and cost savings directly to you.
What each provider sees, what never leaves your tenant, whether any of it trains a model, and where it's processed: the full data boundary and a provider-by-provider breakdown live on the Data residency & governance page.
Compliance
Where we are and where we're headed
GDPR foundations
Active
Data deletion on request, consent-aware processing
SOC 2 Type II
In progress
Formal audit underway
ISO 27001
In progress
Certification audit underway
Comprehensive audit logging
Planned
Full action tracking and access logs