Legal
Security practice
A statement of practice, not a badge wall. If you are reviewing us for procurement, this is what to hold us to — and control documentation is available under NDA on request.
Last updated
Encryption in transit and at rest
Client data is encrypted in transit over TLS and at rest in the underlying platform. Credentials and API keys are held in managed secret stores, never in source control, and are scoped to the minimum surface an integration requires.
Intellectual property and code transfer
Custom code written for an engagement transfers to the client on completion of the engagement terms. We do not retain a licence hook over work you paid us to build, and we do not reuse client-specific logic across engagements.
Least privilege by default
Access to client environments is granted per engagement, scoped to named individuals, time-bound, and revoked at handover. Standing access to a production tenant is the exception and is documented when it exists.
Audit readiness
Migrations and integrations are built to leave a trail: append-only logs for agent actions, reconciliation records for data movements, and documented control mapping available under NDA for procurement review.
AI and agent safety
Agents we deploy operate behind an action-control layer: policy is evaluated before execution, anything irreversible stops for a human, and arguments are redacted before logging. Model providers receive the minimum data required and PII is stripped on the client side.
Incident response
Security concerns reach a named engineer, not a ticket queue. Report anything you find to contact@datadaur.com; we acknowledge within one business day and will tell you what we found, including when the answer is that we got something wrong.
Questions about this page go to contact@datadaur.com.