Security

4 min read • 

At Dvina, we believe that groundbreaking innovation shouldn’t come at the cost of security. That’s why we’ve built a platform that delivers cutting-edge AI capabilities with enterprise-grade security as standard—for every user, every workload, and every interaction. Your content is stored and processed within the European Union, and your data’s safety is non-negotiable.

Security Built Into Every Layer

EU-Based Infrastructure

  • EU Data Residency: Your conversations, files and workspace data are stored and processed in GDPR-compliant data centers within the European Union, and AI models run in the same EU environment. A small number of service providers outside the EU support functions such as account emails and payments, under standard contractual clauses; our Privacy Policy lists them.
  • Certified Resilience: Our infrastructure is powered by cloud providers with SOC 2 Type II, ISO 27001, and ISO 27017 certifications, ensuring world-class uptime, redundancy, and physical security.

Enterprise-Grade Security for All

  • Universal Standards: Whether you’re a individual, startup, an SME, or a global corporation, Dvina delivers the same enterprise-level security features to every user—no exceptions, no compromises.
  • Encryption in Transit and at Rest: Data is encrypted in transit with TLS 1.2 or higher (TLS 1.3 wherever your client supports it) and at rest with AES-256-bit encryption. Sensitive settings, such as the credentials of your connected systems, are additionally encrypted by our application.

Smart Connector Security

  • Zero-Replication by Default: Our connectors are designed to integrate seamlessly with your systems without replicating your data. Access is streamlined, not duplicated—keeping your information where it originates.
  • Transparent Replication Notices: For connectors that require data replication to function (e.g., for offline processing or caching), we notify you upfront with clear, detailed explanations.
  • User-Controlled Options: Where applicable, we empower you with choices—opt in or out of replication, or select alternative workflows that align with your security needs.

GDPR Compliance & Beyond

  • Built for the GDPR: Dvina’s processing is designed around the General Data Protection Regulation, including data residency, user consent, the right to erasure, and data portability, with self-service export and deletion in the product.
  • Privacy by Design: Security and privacy principles are embedded into our development lifecycle, from code to deployment, ensuring your data is handled with care at every step.
  • Data Processing Agreements (DPAs): Available on request, our DPAs outline our commitments as a data processor, giving you legal clarity and peace of mind.

Advanced Security Features

Robust Access Management

  • Role-Based Access Control (RBAC): Define granular permissions for teams, projects, and datasets. Access is tightly controlled and auditable.
  • Single Sign-On (SSO): Integrate with your enterprise identity providers (e.g., Okta, Azure AD) for seamless, secure access management.

Proactive Threat Defense

  • Monitoring: We monitor the availability of our services continuously, publish it on our status page, and keep tamper-resistant audit records of security-relevant actions.
  • Security Testing: We conduct security reviews of our software and plan regular independent security testing.
  • Incident Response: In the unlikely event of a breach, we follow a documented incident response plan for containment, mitigation, and transparent communication.

Auditability

  • Activity Records: Sharing changes (what was shared, with whom, by whom) and data actions such as exports and deletions are recorded with timestamps and user attribution.

Secure Development Practices

  • Code Integrity: Changes are reviewed before release, and every service is built by our continuous integration pipelines before it is deployed.

Your Data, Your Control

Dvina doesn’t just protect your data—we give you the tools to govern it. Our platform offers detailed usage analytics and self-service options to delete or export your data whenever you need. For connectors requiring special handling, we provide clear documentation and support to help you make informed decisions.

Our Promise

Security isn’t a feature—it’s the foundation of Dvina. We’re committed to delivering a platform that meets the highest standards of data protection, operational resilience, and regulatory compliance. With your content in the EU and built for the world, Dvina is your partner in building the future of AI without compromise. For security questions, contact security@dvina.ai.