Where we actually stand.
Security pages usually tell you what a vendor has. This one also tells you what it does not, and when. You will find out either way — better here than three weeks into diligence.
Certifications
| Framework | Status |
|---|---|
| SOC 2 Type II | In progress. Controls implemented and evidenced; audit programme under way. |
| ISO 27001 | In progress. Same control set, same programme. |
| Independent penetration test | Scheduled. |
| GDPR | Built for it. You are the controller, we are the processor, and a DPA governs the rest. |
What we hold today is the control set and the evidence for it — enough for most vendor-security reviews to proceed with a dated condition rather than a stop. What we do not hold yet is the report and the certificate. Ask us for the evidence pack.
What is actually in place
Access
Four roles with a defined cascade. Private workspaces by default. Two separate permission systems, so a chat invitation can never become admin access. Periodic access review that flags orphaned grants.
Identity
SSO with passkeys. SAML and OIDC against Okta, Entra or Google Workspace. SCIM directory sync. Enforced MFA. Deprovisioning that sweeps every grant, not just the login.
Audit
Who did what, to what, when — including billing actions. Purged users are pseudonymised rather than deleted, so the record survives. Security events go to a separate archive kept for ten years, locked so the term cannot be shortened and the archive cannot be deleted — including by us.
Perimeter
Web application firewall with OWASP rules and rate limiting, enforcing. Managed TLS. No static cloud credentials anywhere. Secret scanning and dependency scanning on every change.
Retention
Deletion is two-stage: withdrawn immediately, purged after a fixed window. An explicit "empty the bin" for deliberate erasure. Backups with point-in-time recovery.
Operator access
Staff reading a conversation need a specific entitlement — not admin. Personal data is redacted server-side and every read is audited as it happens.
AI brings its own failure modes. We control those too.
Screened both ways. Every text going to a model and coming back, including prompt-injection detection, with sensitivity set per tenant rather than one blunt rule.
Fetched content is treated as hostile. A web page your agent reads is exactly where an injection attack arrives.
Grounded, then argued with. Answers come from your material, then face automated checks, a reviewing agent, or an adversarial one whose whole job is to attack the draft before anyone outside sees it. A person can be the last word where it matters.
Credentials in a vault. Key-managed, scoped to your organisation, with rotation and quarantine.
Not used for training. Your content is not used to train models — ours or anyone else's — and we commit to it contractually, not just on a web page.
Looking things up is not the same right as changing things. Agents get read-only tools by default. Anything that acts on the outside world is turned on deliberately, per tool, and can require a named person to approve each use.
The model never holds your credentials. They belong to whoever set the connection up. The model asks for an action; the platform decides whether it is allowed.
Agents never run anonymously. A multi-step run requires an identified requester. A public visitor always gets an ordinary single answer, and there is no setting that changes it.
Every run is bounded, and every run is on the record. A spending ceiling, a step limit and a time limit — plus a platform-wide bound no configuration can exceed — with a full audit trail and a plain-language reason it stopped.
Runaway spend is a security event. Per-deployment ceilings, per-Goblin throttles, an instant off switch, and a platform-wide pause for autonomous runs.
Data residency
The shared platform runs in a US region and serves UK and EU customers under standard contractual clauses and the UK addendum — a real, contractable mechanism that satisfies most requirements.
Where in-region hosting is a hard requirement, we deploy a dedicated instance in your region, with its own data store, storage, compute, keys and logs. Residency becomes the deployment boundary rather than a policy your auditor has to take on trust — and it narrows your audit scope as well as ours. Scoped and dated in the contract.
Sub-processors
Always
Hosting, storage and model inference; identity; payments; transactional email. Four vendors, listed in full with their purposes and the data each one sees.
Only if you switch it on
Messaging channels such as Slack and WhatsApp. If you never connect them, your data never touches them.
Website only
Consent-gated analytics on dothat.com. Cookies set only if a visitor accepts. It never sees prompts, data or conversations.
The full list — vendor, purpose, data categories and transfer mechanism — is in the DPA, which also commits us to telling you before it changes. Security contact and vulnerability disclosure: security@dothat.com.
Send us your security questionnaire.
We would rather answer it now than discover the blocker at signature.