Security and data hosting, in plain English

Where the data is hosted

• Application, database and uploaded documents: one server at Hostinger, Paris, France.
• Web traffic: Cloudflare sits in front of the website, so requests to getdealos.tech pass through Cloudflare's network on their way to our server.
• Backups: copies are stored with Backblaze (EU Central region) and Cloudflare R2 (EU jurisdiction). Both are listed in the Privacy Policy.
• AI analysis: to write a brief, relevant excerpts of your documents are sent to Anthropic, a US-based AI provider, under Standard Contractual Clauses. Scanned pages that have no text layer are read by Microsoft Azure AI Document Intelligence, as described in the Privacy Policy. Backup AI providers named in the Privacy Policy (OpenAI, Mistral AI) are not switched on.

The full list of providers is in the Privacy Policy and the Data Processing Agreement.

How it is protected

• Encryption in transit. Connections use HTTPS. In our check on 7 November 2026 the connection negotiated TLS 1.3 with a valid certificate.
• Encryption of documents on disk. Uploaded files are encrypted with Fernet (AES-128 with an integrity check) before they are saved. Downloads and analysis decrypt them on the server.
• Separate workspaces. Each customer's data is kept apart at the database and file level, and one customer's account cannot open another's documents.
• Sign-in. Passwords are stored hashed, never in clear text. After seven failed sign-ins in 15 minutes, sign-in from that address is blocked for a while.
• Backups. Every night the database and documents are copied, encrypted with AES-256, and sent to two EU storage providers. We restore a backup into a scratch database every month to prove it works; the last drill passed on 1 November 2026.

What we do not do. The database itself (account details, text extracted from your documents, finished briefs) is not separately encrypted at the database level. It sits on the same protected server, reachable only from inside it, and it is in the encrypted backups. We have not stated disk-level encryption for the whole server because we have not verified it. If your security review needs more than this, ask us.

Certifications. We do not hold SOC 2. We are working towards ISO/IEC 27001 and are not certified yet; the exact status is on the Information Security Policy page.

How long data is kept and how it is deleted

• While you are a customer: we keep your workspace. There is no automatic expiry of documents unless you ask for one.
• Deleting a document: it moves to a trash you can restore from. A daily job permanently removes it, with its file and its extracted text, 30 days later.
• Deleting a workspace or exporting your data: use the request in Settings. A person on our side carries it out and confirms by email. It is not instant.
• After cancellation: per the Privacy Policy, we keep your data for a 30-day wind-down so you can export it, then delete it, sooner on request.
• Backups: old copies roll off on a fixed cycle. Daily backups on our server are kept about 14 days, weekly ones about 8 weeks, and the off-site copies 30 days.
• Support chat logs: shortened and masked, deleted after 90 days.

Who can see your data

• You and the people you invite to your workspace.
• One Devaland administrator account exists on the platform. It can open a customer workspace in a view-only mode for support, and each opening is written to an audit log. It can also download a customer's document, which we would do only to fix a problem you reported.
• Our AI provider sees the excerpts sent to write your brief (see above).
• Nobody else at Devaland has an account on the platform.

A mutual NDA can be signed inside your workspace before you upload anything.

More detail

Privacy Policy · Data Processing Agreement · Information Security Policy · GDPR · Contact us with any question this page does not answer. To report a security issue, write to [email protected].