How we protect your work.
DAVAI Trace produces diligence a committee can rely on — so the platform underneath it is built to the same standard. This page summarises how your data is secured, isolated and handled.
Security posture
Single sign-on & MFA
Sign-in runs through WorkOS-hosted authentication — no passwords stored by us. Multi-factor authentication (authenticator app + one-time backup codes) is available on every account.
Per-tenant isolation
Every customer's reports, documents and usage are separated at the database layer with PostgreSQL row-level security, enforced on the connection rather than trusted to the application code.
Encryption in transit
All traffic is served over HTTPS with TLS 1.2+ and automatically renewed certificates. There is no unencrypted path to the application or its API.
Encrypted off-site backups
The database is backed up on a schedule to encrypted object storage held separately from the application host, so data survives a host-level failure.
Provenance by design
Every claim in a report links back to the source it came from, and the databases queried are shown up front. Diligence output is auditable rather than taken on trust.
Admin audit trail & roles
Administrative actions are recorded, and access is role-scoped — reviewers, editors and admins see only what their role allows.
How your data is handled
What we store
Your account, the diligence questions you ask, the reports and chats they produce, and any documents you upload. Reports carry the evidence trail behind every claim so they stay auditable.
AI processing
To answer a question we send it, with the evidence retrieved for it, to our model providers (listed below) for inference under their data-processing terms. Your content is used to produce your result — not sold, and not shared with other customers.
Retention & deletion
You can delete a report or document at any time. On account closure we delete your account data on request. Encrypted backups age out on their normal rotation.
Your control
Reports export to DOCX, PDF and PPTX, and references export to BibTeX and RIS — your work leaves with you. Access inside a workspace is scoped by role.
Compliance status
An honest snapshot — what is live today, and what is on the way.
Sub-processors
The third parties that help us run the service. Each processes only what its function requires.
| Provider | Purpose | Region |
|---|---|---|
| phoenixNAP | Application, database and knowledge-graph hosting | United States |
| Anthropic (Claude) | Language-model inference for report generation and chat | United States |
| OpenAI | Language-model inference for evidence classification and enrichment steps within the pipeline | United States |
| Moonshot AI (Kimi) | Language-model inference for polarity grading of PUBLIC literature (published abstracts) and relationship extraction. Under an enterprise provider policy it never receives customer documents, chat prompts or report drafts — those are routed to the US providers above. | Singapore / China |
| WorkOS | Authentication, single sign-on and directory sync | United States |
| Optional Google sign-in, and outbound transactional email | United States | |
| Stripe | Subscription billing and payment processing | United States |
| Cloudflare | Encrypted off-site backup storage and DNS | United States |
| Sentry | Application error monitoring and diagnostics | United States |
Running a security review?
We're happy to complete a questionnaire, share a DPA, or walk your team through the architecture.