Trust & Security

• Primary Database & Storage: Your core account metadata, tenant configurations, project workspaces, vector embeddings, and uploaded files are hosted in EU data centers (Frankfurt, Germany) utilizing Supabase Inc. as our backend infrastructure partner.
• Application Hosting: The web application and frontend logic are hosted on Vercel with traffic from European visitors automatically routed through EU-based edge nodes.

Drall is currently mapping its internal controls to prepare for its own independent SOC 2 audit and all of our core infrastructure sub-processors hold active, top-tier security certifications:

• Supabase / AWS: Hold active SOC 2 Type II and ISO/IEC 27001 certifications.
• Vercel: Maintains active SOC 2 Type II and ISO/IEC 27001 certifications.
• Microsoft: Fully compliant with SOC 1/2/3, ISO 27001, and ISO 27018 standards.

No. We enforce a strict zero-training policy:

• We do not use your client documents, project notes, agent prompts, or generated outputs to train, fine-tune, or evaluate our proprietary workflows or any model from our third-party LLM providers.
• All foundation model providers are connected exclusively via enterprise commercial API endpoints. Under these providers' API business terms, data submitted to the APIs is legally barred from being used for model training or improvement.
• Providers may retain API inputs and outputs for a limited period solely to detect abuse and misuse, after which they are deleted. That retention is contractually confined to this purpose and never extends to model training.

By default, some standard API requests to model providers (such as OpenAI, Anthropic, and Google Gemini) may be processed in secure US data centers, fully protected by EU Standard Contractual Clauses (SCCs).

For clients with strict data sovereignty mandates, Drall can offer dedicated European-only routing on our Enterprise Tier. In this configuration, all LLM API payloads are routed exclusively to model instances located physically within the European Economic Area (EEA) (e.g., Azure OpenAI in Sweden/Switzerland, or Anthropic/Google EU-geofenced endpoints). In this case, no data is transmitted outside the EU.

Rather than cloning or maintaining duplicate file servers, Drall uses an advanced "Storage-by-Reference" architecture:

• No File Bytes Stored: When you connect SharePoint or OneDrive, Drall does not copy or permanently store your original document file bytes.
• On-Demand Processing: We ingest the document metadata (name, path, size) and generate mathematical vector embeddings (stored in our EU Supabase database) for AI semantic search. The raw document text is read dynamically from the Microsoft Graph API when an agent requires it, processed in-memory, and immediately discarded.
• Revocable Consent: Connection is initiated via OAuth 2.0. Directory IDs, application tokens, and client secrets are stored in our database using AES-256-GCM encryption. Organization-wide access can be instantly revoked by a Microsoft Entra ID global administrator at any time.

Yes. Drall prevents internal privilege escalation (e.g., a junior consultant retrieving a restricted partner-only financial document through the AI search):

• ACL Ingestion: Along with the document metadata, Drall imports the native Microsoft 365 Access Control Lists (ACLs) and user/group active directory identifiers.
• Query-Time Filter Enforcement: At the moment a user prompts a Drall agent, the search query dynamically matches the user's logged-in active directory identity against the document's ACL. Users only ever receive AI search results, summaries, or analyses from files they are already natively authorized to read inside Microsoft 365.

• Database Layer Separation: We operate a robust multi-tenancy architecture. Logical data separation is enforced at the database engine level via Supabase PostgreSQL Row-Level Security (RLS). Every database query executed by the application is systematically validated against the user's active tenant identifier. It is physically impossible for a query executed on behalf of Tenant A to access, view, or modify rows belonging to Tenant B.
• Agent Context Sandboxing: AI agent executions, workflow gates, and prompt processing occur within isolated sandboxed memory spaces. Context windows are cleared upon task completion, preventing any persistent cross-tenant or cross-project data leakage.

To support enterprise identity lifecycle management, Drall is currently preparing SAML 2.0 and OpenID Connect (OIDC) integrations for Enterprise Tier workspaces.

This will allow centralized authentication, automated user provisioning/deprovisioning, and enforcement of corporate Multi-Factor Authentication (MFA) policies via identity providers such as Microsoft Entra ID (Azure AD), Okta, Ping Identity, and Google Workspace.

According to Annex II of our standard Data Processing Agreement, we enforce the following security measures:

• Transmission Control (In-Transit Encryption): All network communications, UI traffic, and API integrations are encrypted using TLS 1.2 or higher. Session cookies utilize strict Same-Site policies and HTTP-only flags.
• Data Encryption (At-Rest Encryption): All underlying databases, file metadata, and persistent cloud storage partitions are encrypted using AES-256 (or equivalent industry-standard cryptographic algorithms).
• Access Control: User access is controlled by structured authentication. Internally, employee access to database environments and backend infrastructure is restricted on a strict "need-to-know" basis, governed by unique credentials and role restrictions.
• Availability Control: We conduct regular automated backups of the PostgreSQL database and metadata stores, relying on redundant cloud infrastructure to guarantee high availability and prevent data loss.

Drall aligns with industry-standard service level indicators, contingency planning, and security incident response frameworks:

• Logging & Automated Alerting: Application events and an audit trail of user and agent actions are recorded continuously, and server-side errors are logged and forwarded to an alerting channel. Dependencies and CI actions are checked against known advisories weekly, and every code change runs through automated test checks.
• Breach Notification Commitments: In accordance with GDPR (Art. 33), in the unlikely event of a verified security incident affecting customer personal data, Drall guarantees written notification to the affected Customer (Data Controller) without undue delay, and no later than 72 hours after becoming aware of the breach.
• Designated Response Team: We maintain an internal incident response protocol to isolate affected hosts, revoke compromised credentials, and initiate forensic analysis.

• On-Demand Deletion: Users can manually delete documents, workspaces, or entire client projects directly within the UI.
• Cascading Deletion upon Account Closure: When you delete your organization's account, Drall triggers a real-time, cascading hard deletion of all related database records from our production environments. There is no intermediate "soft-delete" or recovery grace period.
• Backup Lifecycle: Residual references in automated database backups are naturally overwritten and permanently purged as the backup media rotates through its predefined retention cycle.

Yes. Drall is committed to the safety of our platform and values the contribution of ethical security researchers. If you discover a security vulnerability or potential exposure within Drall, please report it to our security team immediately:

• Contact Email: hello@drall.ai
• Reporting Guidelines: Please include a clear description of the vulnerability, steps to reproduce, and any relevant proof-of-concept (PoC) code or screenshots.
• Safe Harbor: We commit to not pursuing legal action against researchers who discover vulnerabilities responsibly, do not attempt to access other tenants' data, do not execute Denial of Service (DoS) attacks, and allow our team a reasonable timeframe to remediate the vulnerability prior to public disclosure.