Security at D8alytics.
How we protect your account, your content and the datasets you generate.
Last updated: 7 August 2026
1. Encryption
- In transit — every connection to D8alytics and to our API uses HTTPS with TLS 1.2 or above. Plain HTTP is redirected, never served.
- At rest — databases and object storage are encrypted using AES-256 by the underlying platform.
- Passwords — never stored. We keep only a salted one-way hash, and we cannot recover your password, only help you reset it.
2. Accounts and authentication
- Sign-in is email and password, with email confirmation at registration.
- Password reset links are single-use and time-limited.
- Sessions use short-lived tokens that refresh automatically and expire when you sign out.
- Administrative pages are protected server-side, not merely hidden in the interface.
3. Data isolation
Every customer's data is separated at the database level by row-level security policies, so a query can only ever return rows belonging to the account that made it. This is enforced by the database itself rather than by application code, which means a mistake in the application cannot expose another customer's data.
Generated datasets are written to private, per-customer storage. There is no public URL. Downloads are served through short-lived signed links that expire after a few minutes.
4. API keys
- A key is shown to you once, at creation. We store only a SHA-256 hash, so even we cannot recover the original.
- Keys can be revoked instantly from the API keys page, and stop working immediately.
- Each key records when it was last used, so an unexpected key is easy to spot.
- Requests are rate-limited per key, per plan.
5. Internal access
- Access to production systems is limited to named administrators.
- We do not browse customer prompts, images or datasets. Access happens only to investigate a fault you have reported, or where we are legally compelled.
- We do not use your content to train models. See our Privacy Policy.
6. Monitoring and logging
We record job status, errors and performance so we can detect failures and abuse. Logs capture technical detail — timings, error messages, identifiers — not the content of your datasets. Security and error logs are kept for up to 12 months.
7. Backups and recovery
Databases are backed up automatically by our hosting provider on a daily cycle. Backups are encrypted and are overwritten as the cycle rotates. Closing your account removes your data from live systems first, and from backups as they rotate, within 30 days.
8. Our providers
We build on established infrastructure providers for hosting, GPU compute, storage, payments and email. Each processes customer data under its own published data-processing terms, which permit processing only on our instructions. We review this list as the service changes, and will share the current named list with customers on request.
9. If something goes wrong
If a security incident affects your personal data, we will investigate it, contain it, and notify affected customers and the relevant supervisory authority without undue delay, and within 72 hours where the GDPR requires it. Our notice will describe what happened, what data was involved, what we have done, and what you should do.
10. Reporting a vulnerability
If you believe you have found a security issue, please tell us at [email protected] before disclosing it publicly. Include enough detail to reproduce it.
We ask that you do not access, modify or delete data belonging to anyone else, do not degrade the service, and do not run automated scans against production. We will acknowledge your report, keep you updated, and credit you if you would like us to. We will not pursue legal action against researchers who follow these guidelines in good faith.
11. What we do not have yet
We would rather tell you plainly than imply certifications we do not hold:
- We are not currently SOC 2 or ISO 27001 certified. We follow the practices described above, but they have not been audited by a third party.
- We do not yet offer single sign-on, hardware key or two-factor authentication.
- We do not yet offer customer-managed encryption keys or a dedicated single-tenant deployment.
If your organisation needs any of these before it can adopt D8alytics, please tell us — it genuinely helps us prioritise.