Security & trust
Every control here is live in production today — not a roadmap slide. This is what actually protects your data.
Security pillars
Defense in depth, by design.
Six controls working together — not one checkbox standing in for real security.
EU data residency
Storage, retrieval, and model inference all run on EU infrastructure, end to end.
Encryption everywhere
Data is encrypted in transit and at rest, with no exceptions for convenience.
Strict tenant isolation
Row-level security at the database layer — a bug in application code can never leak across tenants.
Single sign-on
Enterprise SSO via Microsoft Entra ID, so access follows your existing identity system.
Role-based access control
Deny-by-default roles (viewer, member, admin, owner) enforced on every request.
Append-only audit logs
Every access-relevant action recorded — who did what, when, provable on demand.
Security controls
We built this the way we'd want a vendor to treat our own data.
Four commitments that aren't buried in a settings page.
- Your data is never used to train foundation models — by default, not by opt-out.
- GDPR data export lets you take a full copy of your tenant's data at any time.
- Right-to-erasure is technically real: a request removes data from every layer, including search indexes.
- Every administrative action is logged, so an access review is a query, not a reconstruction.
Certifications & roadmap
Honest about where we are.
We'd rather tell you the truth than claim a badge we don't have yet.
ISO 27001
In progressSOC 2 Type II
In progressGDPR / DSGVO
Compliant today
Formal certifications take time to earn honestly. Our architecture (EU residency, encryption, tenant isolation, audit logs) is built to the standard these certifications require — we'll update this page the moment each is awarded.
A short, deliberate list.
DARA runs on Microsoft Azure (EU regions) for infrastructure and Microsoft Entra ID for identity. We keep the sub-processor list short on purpose — every additional processor is another party with access to your data, so we add one only when it clearly earns its place.
Security FAQ
Questions your security team will ask.
Have a security questionnaire to send us?
Our team will walk your security and compliance stakeholders through the architecture directly.
Talk to our security team