Security, data & privacy

Protecting Customer Data

All Customer Data stored on platform infrastructure is encrypted at rest using AES-256, and TLS 1.3 is enforced for all data transmission between clients and platform services. The platform is hosted within a virtual private cloud (VPC) environment with network segmentation and firewall controls.

DASA conducts regular penetration testing by independent third parties and continuous vulnerability scanning, and maintains a responsible disclosure policy.

Organisational data separation

Each enterprise customer is provisioned with a dedicated organisational instance within the Aidrian platform. Customer Data is stored in logically isolated data environments, segregated by organisation ID at the data layer. No End User data, performance data, or configuration data from one organisation is accessible to or mixed with any other organisation.

All access to Customer Data — including by DASA support and engineering personnel — is logged and auditable.

Access to individual data

Role-based access control (RBAC) is enforced at platform, organisational, and data layer levels. Individual users see only their own data, while Mentors and Leaders see only anonymised, aggregated team trends. Access to Customer Data by DASA personnel is granted on a least-privilege basis and is logged and audited.

Azure OpenAI and model training

Aidrian uses Azure OpenAI, deployed in an EU region, to generate analysis and guidance. Customer performance data sent to Azure OpenAI is processed under Microsoft's enterprise terms and is never used to train or improve the underlying models. Before any data is sent, Aidrian removes direct identifiers, such as names, email addresses, and organization names, so prompts don't identify individual people or the customer organization.

Human review of AI recommendations

All AI-generated outputs are advisory in nature. The platform does not make fully autonomous decisions with legal or similarly significant effects on you. Automated nudges and AI recommendations to Team Members are always routed through a designated Mentor for review and approval, so no AI-generated recommendation reaches an End User without a human approval step in the workflow.

Data from connected systems

Aidrian is designed to operate on aggregated and anonymised metrics rather than raw personal or project-specific data. Performance insights from integrations use aggregated metrics such as lead time, cycle time, review latency and deployment frequency. Aidrian does not require access to production data or confidential business information to operate.

Data retention

End User platform data is retained for the duration of the active subscription term. A Customer may request a full data export within 30 days of the termination date. Unless a legal retention obligation applies, Customer Data is also deleted or returned within 30 days of termination. Security and audit logs are retained for up to 12 months from generation.

Security incidents

DASA maintains a formal incident response procedure. Upon becoming aware of an incident, DASA notifies the affected Customer without undue delay and in accordance with GDPR Article 33 / 34 timelines, typically within 72 hours. DASA implements remediation measures and provides a post-incident report to the Customer.

Security information and assurance

As part of their security due diligence or procurement process, Customers may request confirmation of isolation controls and access logs, the current list of authorised sub-processors and their roles, and written confirmation of compliance with contractual data residency requirements. DASA will provide reasonable technical information to support Customer Data Protection Impact Assessments (DPIAs) under GDPR Article 35.