Security & Privacy

Duvo is an AI-native automation platform that automates complex processes across UIs and APIs. The platform is designed so that automation reduces risk: assignments operate within strict access boundaries, every action is auditable, and our use of AI vendors is governed by clear contractual and technical controls.

---

1. Security Governance & Control Framework

Control framework

• Duvo is SOC 2 Type II certified

• Controls aligned with SOC 2 Trust Services Criteria (Security, Availability, Confidentiality)

• Duvo maintain strict controls around data security, availability, and confidentiality

Risk & oversight

• Security and risk reviewed at executive level on a regular cadence.

• Annual formal risk assessment with documented treatment plans and remediation tracking.

Policies & compliance

• Core policies (Information Security, Access Control, Vendor Risk, Data Protection & Privacy, Incident Response, Acceptable Use) reviewed at least annually.

• All Duvo employees complete mandatory security and privacy awareness programs at onboarding and annually thereafter.

---

2. Infrastructure & Platform Security

Hosting & network

• Hosted on leading cloud providers with hardened configurations and network segmentation.

• Full disclosure of subprocessors available upon request.

Identity, access & MFA

• All access to production systems is authenticated, role-based, and enforced with MFA and least-privilege.

Encryption & key management

• In transit: TLS 1.2+ for all external and internal service communications.

• At rest: Industry-standard encryption (e.g., AES-256) for databases, storage, and backups.

• Keys managed via cloud-native KMS, with access controls and rotation policies.

Endpoint & device security

• Company endpoints use full-disk encryption

Monitoring, availability & incident response

• Centralized logging and monitoring of infrastructure, application health, and security-relevant events.

• Redundant, multi-AZ architecture designed to minimize downtime.

• Documented incident response plan, on-call rotation, and post-incident review process.

Vulnerability management

• Regular automated scanning of infrastructure and applications.

• Patch management and remediation timelines driven by risk severity.

---

3. Application, Assignment & Browser Security

Authentication, SSO & RBAC

• Unique accounts for all users

• Fine-grained RBAC across:

  • Human roles (admins, managers, users).

  • Assignments themselves (which systems, environments, and actions an assignment can perform).

  • Assignments can only access systems that are within security scope of users using the assignments to perform processes

Tenant isolation

• Logical segregation of customers at the application and data layers.

• Cross-tenant access is technically prevented; multi-tenant components enforce tenant scoping in all queries.

Secure SDLC & environments

• All production changes are peer-reviewed and tracked in version control.

• Automated and manual testing (including regression and security checks) before deployment.

• Strict separation of dev / staging / production; production data is not used in lower environments.

Automation & Duvo "Enterprise Browser"

• UI automation runs in ephemeral remote browser sandboxes, not on end-user devices.

• Browsing sessions are isolated per task, local storage is not shared between customers.

• Logins for target systems (e.g., internal portals) are stored in hardened secret stores and scoped to specific assignments/workflows.

Human-in-the-loop & approvals

• Assignments can be configured to request explicit human approval for high-risk actions (e.g., changes in internal systems, sending external emails).

• All approvals, rejections, and resulting actions are fully logged.

Auditability

• Comprehensive audit trails for assignment jobs, configuration changes, access changes, and approvals.

---

4. Data Protection & Privacy

Data classification & lifecycle

• Retention and deletion policies for logs, configuration, and content aligned with contractual and regulatory obligations.

Access to customer data

• Role-based, need-to-know access to production data; approvals and access are time-bound wherever possible.

• All privileged access is logged and regularly reviewed (at least quarterly access reviews).

Privacy & regulatory alignment

• Program aligned with GDPR principles, support for data subject rights (access, deletion, rectification) through defined processes.

• Public Privacy Policy, DPAs, and list of sub-processors available on request.

Deletion & anonymization

• Capabilities to delete or render data unusable on request, including end-user content and workspace data, subject to legal and backup constraints.

---

5. Use of AI / LLM Providers (Anthropic ZDR & Others)

Anthropic as primary AI provider

• Duvo integrates Anthropic's Claude models as a core reasoning engine under enterprise commercial terms.

Zero Data Retention (ZDR)

• All Anthropic API calls from Duvo are made in Zero Data Retention mode:

  • Prompts and outputs are not used for model training,

  • Not retained beyond transient processing by Anthropic.

• Duvo does not use Anthropic's consumer interfaces (e.g., free/pro web UI) for customer workloads.

Data minimization & protection with LLMs

• Only the minimal context required to perform a task is sent to the model.

Other model providers / BYO endpoints

• Support for other enterprise LLM APIs and customer-hosted model endpoints.

• You can constrain the platform to specific providers, regions, or endpoints that satisfy your data residency and compliance requirements.

Vendor risk management

• Critical sub-processors (LLM providers, cloud, browser sandboxing, observability) undergo security and privacy review.

• DPAs and data-handling terms are in place, with clear limits on data use and confidentiality obligations.