Security

Doris primarily analyzes what is already public on your website. Beyond that, we only store what is needed to run your account and show your history, such as your email address and your analyses.

We don't collect more than we need, and we never sell your data.

All traffic to and from Doris is protected with TLS, so no one can read it along the way. Data stored with us is encrypted at rest by our cloud providers.

Your data is primarily stored within the EU/EEA with established cloud providers. For some parts, we use subprocessors that may process data outside the EU, such as our payment provider and the provider that runs the AI analysis.

When data is processed outside the EU/EEA, it is done with safeguards such as the European Commission's Standard Contractual Clauses. A current list of subprocessors is in our privacy policy.

Only those of us who need access to systems and data have it, and only to the extent the work requires. Access is protected by sign-in and reviewed.

Payments are handled by Stripe, one of the world's most established payment providers. Your card details go directly to Stripe and are never stored with us. Stripe is certified under PCI DSS, the industry standard for card handling.

You own your data. You can see it in the service, and you can delete it and close your account yourself at any time. We then remove your personal data, except what we are required by law to keep, such as accounting records.

If you want a copy of your data, email [email protected] and we'll send it to you. There is no button for that in the service yet.

How we process personal data is described in our privacy policy.

If you find a security problem, we want to hear about it. Email [email protected] with a description of what you found and how we can reproduce it.

We'll get back to you as soon as we can, and we ask that you give us reasonable time to fix the problem before you tell others about it. Never test in a way that puts other people's data at risk or disrupts the service.