Security

She asks before she acts.

An assistant that can act on your systems is a different kind of risk from a chatbot that cannot. The guarantees below are the ones the product is built around, and each one says where it is enforced. A guarantee that depends on a model behaving well is not a guarantee.

The guarantees

Nothing leaves without you, character for character

By default, every message that leaves your company under your name stops at a card in Slack first: an email to a customer, a post in a channel, a campaign that starts sending. The card shows the full text with approve, or edit and approve. What you approve is what arrives. Nothing is appended, trimmed, improved or re-generated after you press the button.

Technically enforced, not left to a model instruction. You can allow actions in advance, for one kind of action and a period you choose, and you can take that back at any time. Payments always ask.

A private source answers you privately

A connection or a part of your company brain can be marked sensitive. Nisa still reads it, and the answer comes to you as a card in a direct message instead of into the shared thread. A pack can also be marked so it is never used on a shared surface at all.

Technically enforced, not by asking a model to keep a secret.

Her memory belongs to the room, not to whoever is asking

What she learns in a direct message stays out of what a channel can recall. Two people can correctly get different answers to the same question, because she acts with the access of the person asking rather than one shared master key.

Technically enforced, not by a prompt.

Your company brain is files, not weights

What Nisa knows about your company is a set of markdown files you can open, read, correct and delete. A wrong fact is a line in a file. When a person asks to be forgotten, there is a specific thing to remove rather than "somewhere in the model". And if you leave, you leave with your knowledge.

Visible in the product under Brain. Nothing about your company is trained into anything.

Each job runs on its own machine

A job gets a sandboxed machine in the cloud holding only the tools that job needs, and it is torn down when the job is done. Nothing runs on your laptop and nothing persists on that machine afterwards.

That is also why she can work for twenty minutes across several tools and keep going after you close Slack.

Built to the GDPR as the floor

DramaLabs, Inc., a Delaware corporation. The GDPR is the floor we build to rather than a box we tick, and your messages, files and connected data are never used to train a model, ours or a provider we route to.

The processors we rely on are named on our trust page, and we tell you before adding a new one. A signed DPA is available.

Compliance

GDPR compliant · SOC 2-aligned controls · No training on your data · Data stored in the EU

Compliant, not certified: no SOC 2 or ISO 27001 audit has been completed yet.

The honest part

None of the above stops Nisa from being wrong. She is a model doing real work against messy data, and some percentage of the time the answer is wrong, the approach is wrong, or she confidently misread what you asked for.

What the guarantees do is stop a wrong answer from becoming an irreversible action without a person, and stop her reaching data nobody gave her. For the wrong answers themselves the tools are different ones: she says what she looked at and what she skipped, she shows a plan on anything with several steps so you can stop it, and when a tool fails she says so in the channel instead of quietly retrying.

We hold no security certification and this page claims none. What we can put in front of you is the trust page, the list of processors, and a signed DPA.

Read the detail

DramaLabs, Inc., a Delaware corporation. For a security review or a signed DPA, reach us through the Contact page.