Security
Your data. Your control.
Enterprise-grade infrastructure, provisioned for every company, priced for smaller businesses. An honest look at how we protect your data today and what we're building toward.
Data Isolation
Per-company isolation
Every company gets its own isolated infrastructure: its own database, storage, and access boundaries. Data stored with us is encrypted at rest and in transit. Per-organisation encryption keys, including the option to bring your own key so you control who can decrypt your data, are rolling out. There is no cross-tenant data access.
David is hostable in the UK, EU, or US, so you choose where your data lives.
Infrastructure
What's in place today
Hostable in UK, EU, or US regions
Storage encrypted at rest; per-organisation keys and bring-your-own-key rolling out
Per-company infrastructure isolation
Role-based access, management, and onboarding flows
Encrypted in transit via HTTPS across all services
AI Providers
Vetted providers, clear boundaries
David uses the major AI providers you've heard of, including Anthropic, OpenAI, and Google, alongside specialist providers whose models work better for specific agentic tasks. We've done the hard work of evaluating which model works best for what, and vetting each provider's data policies, so you don't have to.
No vendor lock-in: Unlike assistants from Anthropic, Google, or OpenAI that only use their own models, David is provider-agnostic. As better models emerge (including open-source ones), David adopts them, passing on improvements in capability and cost savings directly to you.
What each provider sees, what never leaves your tenant, whether any of it trains a model, and where it's processed: the full data boundary and a provider-by-provider breakdown live on the Data residency & governance page.
Compliance
Where we are and where we're headed
GDPR foundations
Active
Data deletion on request, consent-aware processing
SOC 2 Type II
In progress
Formal audit underway
ISO 27001
In progress
Certification audit underway
Comprehensive audit logging
Live
Actions, approvals, support access and partner access are all logged