Security

How we protect your conversations

This page describes the security controls that are in place in the Drellia platform today. We keep it factual: if something is not listed here, we don't claim it.

Hosting

  • The platform runs on Amazon Web Services (AWS).
  • Our primary region is Stockholm (eu-north-1), in the European Union, where the application, database and file storage run.
  • The database runs in a private network and is not reachable from the internet.

Encryption

  • All traffic to the web app and APIs uses HTTPS; the web app requires TLS 1.2 or later and redirects plain HTTP to HTTPS.
  • Connections from the application to the database use TLS.
  • Call recordings and uploaded files are stored encrypted at rest (AES-256).

Isolation between organizations

  • Every organization's data is separated in the database with row-level security policies per organization, applied to the queries the application makes on behalf of users.
  • An automated test blocks any release that adds an organization-scoped table without an isolation policy.
  • Call recordings are stored under a separate location per organization.

Access control

  • Sign-in is handled by Auth0, a dedicated identity provider.
  • Each member has a role in their organization (Owner, Admin, Supervisor or Operator) that decides what they can see and do.
  • Access is denied by default: every API route must declare which permission it needs, and an automated test fails the build otherwise.
  • API keys can be given an expiry date and revoked at any time.

Monitoring and protection

  • Our APIs sit behind a web application firewall with managed protection rules and rate limits.
  • Changes made in the platform are published as audit events that carry the organization, the user and the time.

Backups and continuity

  • The database is backed up automatically, with backups kept for seven days and protection against accidental deletion.
  • Call recordings and files are stored with versioning, so an overwritten file can be recovered.

AI and service providers

To transcribe, analyze and voice conversations, Drellia sends conversation content to specialized providers of speech recognition, speech synthesis and language models. These providers may process data outside the European Union. Contact us for the current list.

How we collect, use and retain personal data, and how to exercise your rights, is described in our Privacy Policy.

Certifications

Drellia does not currently hold third-party security certifications such as SOC 2 or ISO 27001. When we start or complete a certification, we will say so here, clearly marked as planned or achieved.

Running a security review or have a questionnaire for us? Write to contact@drellia.com.