Our first priority.
All workspace data is managed through a single security layer, in line with your company policies.
Built with you in mind.
Workspace data is stored in the U.S. and handled under SOC 2 controls.
A data processing agreement is prepared separately for each customer and use case.
We meet GDPR requirements, and all stored and processed data sits in certified data centers.
A technical architecture that supports attorneys' and CPAs' duty of confidentiality.
Your data's secure path.
- Data
All of your data is stored encrypted in data centers in the United States.
- Request
Requests are processed in line with your organization's policy.
- Response
AI responses return to your workspace and are logged for audit.
- Provider
Your data is not retained and never used to train models.
Every detail for your security team.
Davy helps your team follow your company's access and data policies while working with AI. Access to information, model use and action permissions are managed together across chats, assistants and integrations.
Right information, right permissions
Users can access only the information and tools within their permissions. Boundaries set at the company, department and project level are enforced when data is accessed and when tools are run.
Connecting an integration does not open all of its data to everyone. Assistants and automations also work within the permissions assigned to them.
Controls that fit your company for sensitive data
User messages, content retrieved from connected sources and automation inputs are checked against your company's data policies before they are sent to the model.
Depending on the controls, processing of the content may be allowed, detected sensitive fields may be masked, or the request may be routed to a model in the U.S. Requests that violate policies are blocked. Data protection rules also apply to processing logs and results.
Your data is stored in the U.S. You decide which models are used.
Persistent workspace data is stored on U.S. infrastructure. Your company can safely use open-weight models hosted in the U.S. or the external model providers it approves.
When an external model is used, the content needed for the task is transferred to that provider. The model and processing region are determined by company policy, applicable law and the provider's data processing terms.
If a request must be processed in the U.S. and no U.S. model is available, the operation is stopped. The request is not sent abroad automatically.
Authority to act is never left to the AI
A model suggesting an action does not mean it is authorized to carry it out. On every tool call, access and action permissions are checked on the server side.
Human approval can be required for actions that change data or act in external systems. Your teams keep control over critical steps while using assistants.
Policies are managed in one place, actions are traceable
Users, roles, access boundaries and model policies are managed in one place. The same rules apply in chats, projects, assistants and automations.
The model used, processing region, applied policies and action result are logged. Access to these logs is also limited according to the relevant permissions.
How your data is used is clearly defined.
The AI models used in Davy are secure. Requests are never used for model training, and all of your data is hosted on SOC 2 compliant infrastructure.
To learn more, let's review your company's security requirements together.
Every industry has its own rules.
Frequently asked questions about Davy.
Can we keep all of our data in the U.S.?
Yes. With U.S. infrastructure and suitable U.S.-hosted models, you can keep both persistent data storage and AI model processing in the U.S. The ideal setup is determined by your company's needs.
What information is sent if we use an external model?
Only the content needed for the task and allowed by your company policy is sent. Sensitive information detected is intelligently masked by our technology before sending. Your persistent workspace data is managed separately.
Can we decide which AI models can be used?
Yes. Your company can set which AI models and processing regions may be used. Narrower limits can be defined for different teams, projects and data types.
Can employees access other teams' documents?
Only if they have access permissions. Connecting a data source to Davy or sharing a file does not open every document in it to all employees.
Can we require our approval for actions taken by assistants?
Yes. Human approval can be required for assistants that change data or act in external systems. Assistants work within the permissions assigned to them.
Is our data used for model training?
Your data is never used to train AI models.
If the U.S. model is unavailable, is our data sent abroad?
No. A request that must be processed in the U.S. is stopped and the user is informed. The request is not automatically transferred to a model abroad.
Can our security team run a technical assessment?
Yes. Access controls, data flows, model options and data processing terms can be reviewed together with your security and legal teams.