Privacy & Security at doushi.ai
We treat your datasets, machine learning models, and predictions with the highest standard of enterprise security and confidentiality. Here is how we protect your data.
Frankfurt, Germany Servers
All compute instances, databases, and model training sandboxes are located in ISO 27001 certified data centers in Frankfurt am Main, Germany.
No Training on Customer Data
Your tabular datasets and generated weights remain strictly yours. We never use customer data or proprietary models to train generalized AI models.
End-to-End Encryption
All network traffic is encrypted via TLS 1.3 in transit. Datasets, model artifacts, and database records are encrypted with AES-256 at rest.
1. GDPR & DSGVO Compliance
doushi.ai operates in full compliance with the European Union General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG).
- Right to Erasure: Deleting a project permanently deletes all associated raw data, intermediate feature matrices, and trained model artifacts from our servers and backup cycles.
- Data Processing Agreements (DPA): We provide enterprise Data Processing Agreements with Standard Contractual Clauses (SCCs) upon request.
2. Data Isolation & Sandbox Execution
Every model generation tournament and inference query is executed inside an isolated Docker container sandbox with strict CPU, memory, and filesystem boundaries.
- No cross-tenant data leakage or shared memory states.
- Sandboxes have no write permissions to core systems and execute with minimal operating privileges.
- Temporary intermediate training caches are automatically wiped upon pipeline completion.
3. API Authentication & Token Security
When you deploy a trained model to production, you access it via cryptographically secure REST API tokens.
- Tokens are hashed and stored using industry-standard one-way cryptographic algorithms.
- You can rotate, regenerate, or revoke API keys instantly from your dashboard.
- Rate limiting and anomaly detection protect your endpoints from unauthorized brute-force abuse.
4. Payment & Subprocessors
Subscription payments are processed securely via Stripe Inc. (PCI-DSS Service Provider Level 1 certified). doushi.ai never stores, processes, or sees your credit card or bank account information.
5. Zero Tracking Cookies & Cookieless Attribution
doushi.ai operates completely without third-party advertising cookies, invasive tracking pixels (such as Meta Pixel or Reddit tracking cookies), or cross-site fingerprinting technologies.
- No Consent Banners Required: Because we do not write or read non-essential tracking cookies or unique cross-site identifiers to your local device, our platform remains fast, clean, and free of disruptive cookie consent popups (in full compliance with TDDDG §25 and GDPR).
- Marketing & Campaign Attribution: Incoming campaign links (such as standard UTM parameters) are processed in memory and server-side under legitimate interest strictly to assess aggregate marketing channel effectiveness, without profiling or tracking your browsing behavior across external websites.
Questions or Data Protection Requests?
If you have any questions about data security, need to execute a custom enterprise DPA, or wish to exercise your GDPR rights, our security team is here to assist.
Contact support@doushi.ai →