DIRI AI / Trust Center
Facts about security and data, not promises.
This page summarises what our published documents say about protecting your data. Each block names its source document.
Summary of the published documents version 1.2.0, effective August 30, 2026. If anything here differs, the documents and your agreement apply.
What we do not claim
- No ISO 27001, SOC 2 or PCI DSS certification for DIRI AI. Certifications held by our providers are not DIRI AI certifications.
- No claim of penetration-test coverage.
- No percentage uptime SLA in standard plans, and no promised recovery time (RTO) or recovery point (RPO).
- No public bug bounty programme.
- This page is not a contract and does not extend any agreement.
Source: Security overview, Service availability
Data protection
- Traffic to supported services is encrypted in transit with TLS.
- Managed providers encrypt stored data at rest with their standard controls.
- Card details are entered with the payment provider, so DIRI AI does not need the full card number.
- Storage of voice recordings is off by default.
- Error telemetry is sanitised, and customer content is kept out of routine logs where feasible.
Source: Security overview
Access and company separation
- Every user has their own identity, and production session cookies are protected.
- Permissions are checked on the server, by role and by company account.
- Company administrators manage invitations, roles and member removal.
- Rate limits and anti-abuse controls are in place.
- Security-relevant administrator and subscription events are recorded in an audit log.
Source: Security overview
Changes and operations
- Changes go through review, automated tests and dependency and secret checks.
- Callbacks from providers are signed and verified.
- Errors and operations are monitored, and suspected incidents are handled under the published incident policy.
- Hosting, database, cache and storage run on managed providers; backup and restore are tested.
AI and data minimisation
- AI providers receive only the data needed for the function you request, such as a practice call, transcription or report.
- AI feedback supports practice and coaching. It should not be the only basis for evaluating an employee.
Source: AI model providers, AI transparency notice
Who can see what
| Role | Access |
|---|---|
| Seller | Own training sessions, transcripts and reports. |
| Team manager | All training sessions, transcripts and reports in their company, except a founder's private sessions from before the workspace became a team. |
| Company administrator | The same session access as a team manager, plus users, teams, roles, scenarios and company settings. |
| External coach | A member of one company without administrative permissions; sees only their own training sessions. |
| DIRI AI platform administrator | Training sessions of all companies, for support and platform operations; security-relevant actions are recorded in the audit log. |
Company roles cannot see another company's training data. DIRI AI platform administrators (authorised personnel) can access all companies for support and operations. If you turn on a public competition nickname, that profile is visible to signed-in users of other companies.
Source: Security overview, Privacy policy
How long we keep data
Maximum default periods from the Data Retention Policy. They are upper limits; eligible data can be deleted sooner.
| Data | Default maximum |
|---|---|
| Training transcripts, scores and reports | Up to 365 days; a company can choose a shorter supported period. |
| Stored voice recordings | Off by default; if expressly enabled, up to 30 days. |
| Privacy export archive | Normally 24 hours after it becomes available. |
| Security and administrative audit log | Normally 12 months. |
| Browser session | Up to 8 hours. |
| Account after closure | Deletion from active systems targeted 30 days after the closure and export window, except records the law requires us to keep. |
Source: Data retention policy
Controls you have
- Download a copy of your data from your account. The export link expires.
- Request deletion of your account. Each request is reviewed for identity, legal hold and retention before erasure.
- Show an anonymous nickname instead of your name in team comparisons.
- Company administrators can set how long training data is kept.
Source: Privacy policy, Data retention policy
Providers we use
Provider names from the published Subprocessor List. Their purposes and data categories are in the linked list.
- Vercel
- Render
- Neon
- Upstash
- Cloudflare
- Resend
- Google Workspace
- Google Analytics 4
- Stripe
- Sentry
- OpenAI
- ElevenLabs
- GitHub
Source: Subprocessor list
Service status
The status page checks API health, readiness and signup availability when you open it.
Open the status pageReport a vulnerability
Send the affected route, steps to reproduce and impact. Do not access other customers' data or disrupt the service.
- Security reports
- security@diriai.com
- Privacy incidents
- privacy@diriai.com
Source: Security overview
Published documents
The documents are published in English and Czech.