Trust & Security
We publish our security practices openly.
How We Protect Your Data
6 pillars of security aligned with international standards
AI Transparency
See which models reviewed each record, how they voted, and why. No black boxes. Built with EU AI Act Art. 50 transparency principles. You have access to the full list of models and their capabilities.
Data Protection
Encrypted in transit (TLS) and at rest (AES-256). Built with GDPR principles in mind. Delph-AI never uses your data to train AI models. We process data only for the purpose you specify.
Data Residency
Core application infrastructure—compute, database, and file storage—is hosted in Google Cloud europe-west1 (Belgium). Firebase Authentication is US-based. AI model evaluations are processed by third-party providers in provider-specific regions (see Sub-processors).
Payment Security
PCI-DSS compliant via Dodo Payments (Merchant of Record). We never see, store, or process raw card data. All payments are handled by our payment provider.
Retention & Deletion
Projects: 60-day grace period. Screenings: 30 days. Accounts: 90 days. After grace period, personal data is anonymized. Billing data retained 7 years per fiscal obligation.
Compliance
GDPR principles, EU AI Act, PCI-DSS (via Dodo Payments), LFPDPPP (Mexico), LGPD (Brazil). SOC 2 on our roadmap. We publish our security practices openly.
Service Providers
We work with vetted providers for infrastructure, AI inference, payments, and communications.
Processing locations include the EU, US, and additional disclosed regions depending on the AI model selected. We use contractual and technical safeguards appropriate to each provider relationship, including Data Processing Agreements where applicable.
Questions about our security?
Our team is here to help. Contact us for a detailed security assessment or to discuss your compliance requirements.