Security

    How we keep your data safe.

    Where your data lives

    • Your data is stored in a Postgres database and file storage run by Supabase, in the United States. The app runs on Vercel.
    • Data is encrypted in transit and at rest.
    • Tokens and API keys for the accounts you connect are encrypted again, separately, with AES-256-GCM.

    Each business sees only its own data

    • Every table in the database has row-level security on, so the database itself refuses a request for another business's rows.
    • Doug's servers also check your workspace on every request.
    • Inside a workspace, each person has a role: admin, team member, or viewer.

    What Doug does with your material

    • Doug answers only from the sources you give him. When they don't cover a question, he says so and offers a person.
    • Your sources and conversations are not sold, and they are not used to train AI models.
    • Doug's team does not read your conversations unless you ask us to for support, or security or the law requires it.

    You decide how long data stays

    • Keep conversations forever, or delete them after 30, 90, or 365 days. The deletion runs every day.
    • Export your conversations and leads at any time.
    • Delete a source, a conversation, or the whole agent, and the data goes with it. Disconnect a Google or Microsoft account and we delete its tokens.

    The chat on your website

    • You can limit the chat to the websites you list, so nobody can put your Doug on their site.
    • Each visitor, chat, and site has rate limits, and each Doug has a daily message cap, so nobody can run up your bill.
    • Doug has guardrails against visitors who try to make him ignore his instructions.

    Payments

    • Stripe takes every card payment, for your plan and for booking deposits. Doug never sees or stores a card number.

    What we don't have yet

    We don't hold a SOC 2 report or HIPAA certification today. Don't use Doug to collect health records, card numbers, or government ID numbers.

    Report a problem

    If you find a security issue, email hello@donebydoug.com. The companies that help us run Doug are listed in our privacy policy.