Dataryo is the system of record for documents that matter. We treat that responsibility with the boring, paperwork-heavy seriousness it deserves.
We organize our program around four pillars: data boundaries, identity, observability, and vendor discipline. Every control we ship maps back to one of these.
TLS 1.3 on the wire, AES-256-GCM at rest. Per-tenant encryption keys managed in AWS KMS, with customer-managed keys (CMK) on Enterprise.
Choose US, EU (Frankfurt), or UK (London). Data never leaves the region, including embeddings and AI inference.
Uploaded files are write-once. Transformations produce new records; the source is always reachable by hash.
Contractually. Your files, prompts, and outputs are used to serve your workspace only. This is a term, not a toggle.
SAML 2.0 with Okta, Azure AD, Google, and OneLogin. SCIM provisioning and de-provisioning on Team and Enterprise.
Owner, admin, editor, viewer. Folder-level ACLs. Granular controls for Transformations and export.
Every read, write, prompt, citation, and export — timestamped and exportable. Stream to Splunk, Datadog, or S3.
Every AI output carries a cryptographic manifest of the source chunks it was grounded in. Reproducible, forever.
AWS, Cloudflare, Anthropic, OpenAI, Stripe. All on DPAs. Public list maintained at a dedicated URL.
Zero-retention agreements with all model providers. Enterprise can pin to a single provider or route through a private deployment.
We run a continuous compliance program with drift monitoring across AWS, GitHub, Okta, and our code. Every control has an owner and a review cadence.
We run a private bounty with coordinated disclosure. No lawyers, no NDAs for good-faith research. Report to security@dataryo.com.