Skip to content
Danphe Council

Trust centre

Security at Danphe Council

What protects your documents today, what we have not done yet, and who processes your data.

Certifications

Where we are

No security certifications yet

Danphe Council does not hold SOC 2, ISO 27001 or any other certification today. We will list a certificate here only once it is issued, with the report available on request.
  • SOC 2 Type IIPlanned
  • Independent penetration testPlanned
  • ISO/IEC 27001Under consideration

Controls

What is in place today

  • Encryption per tenant

    Data is encrypted in transit (TLS) and at rest. Stored files and sensitive fields use a separate encryption key for each organisation, managed in AWS KMS, so deleting an organisation's key makes its data unreadable.

  • Isolation between organisations

    Every organisation's data is separated by PostgreSQL row-level security, forced on every tenant table. Automated tests try to read across organisations and must fail.

  • Tamper-evident audit chain

    Each answer's audit record is hash-chained to the previous one and anchored with an asymmetric signing key. A verifier detects any later change to a record.

  • No training on your data

    Your files, questions and answers are not used to train models, by us or by the model providers we use under their enterprise terms.

  • Upload checks

    Uploaded files are quarantined and scanned for malware before they are read. Files that fail are rejected.

  • Roles and least privilege

    Workspace roles limit who can change models, policies and settings.

  • Vendor controls

    Workspace rules can restrict which model vendors may be used and require providers that do not retain prompts or outputs.

  • Secrets

    Credentials are never stored in code. Model output is rendered without scripts or remote images.

Sub-processors

Who processes your data

Sub-processors
CompanyPurposeData
Amazon Web ServicesHosting, storage, encryption keys; AI models through Amazon BedrockAccount data, documents, questions and answers
Microsoft AzureAI models through Azure OpenAI and Azure AI FoundryQuestions and the document passages needed to answer them

The full list with locations is on the sub-processors page. We give 30 days' notice of changes to customers with a DPA.

Report an issue

Responsible disclosure

Found a vulnerability? Email trust@danphe.ai with the details and steps to reproduce. Please give us reasonable time to fix it before disclosure, and do not access other customers' data. We do not run a paid bug bounty yet.

Security questionnaires and the AI system card: see AI system card or contact us.