Designed around privacy law, not bolted on
DICE was built for businesses in Canada (PIPEDA, Quebec Law 25), Turkey (KVKK) and the EU (GDPR). Below is what the product does today. We do not claim certifications we do not hold.
Controls in the product
Tenant isolation
Every row of customer data carries its business id and is filtered by PostgreSQL row-level security, tested on every build.
Encrypted secrets
API keys and tokens are stored with envelope encryption and are never shown again after saving.
Tamper-evident audit log
Staff and system actions are written to an append-only, hash-chained log. It stores field names, never personal data.
Two-factor authentication
Required for DICE staff. Available to every user, with passkeys.
Consent records
The exact consent text and policy version are stored with each consent. Withdrawal is one reply away.
Export and deletion
One-click data export. Deletion covers the database, search vectors and files, and ends with a deletion certificate.
No personal data in logs
Application logs redact personal data and secrets by design.
Encrypted backups
Nightly encrypted backups with an automated weekly restore test.
Safe crawling
The crawler obeys robots.txt and refuses private network addresses, so a website cannot trick it into internal systems.
Compliance questions
Is DICE certified?
Not yet. We describe the controls that are built into the product today and do not claim certifications we do not hold.
How is my customers’ data separated from other businesses?
Every tenant row carries its business id, and PostgreSQL row-level security filters every query. An automated isolation test suite runs on every build.
Can DICE staff see my conversations?
Only through time-limited, logged impersonation with a stated reason, and you receive a notice when it happens.
Can we sign a DPA?
Yes. Our data processing agreement is published in the trust center and forms part of the terms.
How do we handle a deletion request from one of our customers?
Use the privacy tools in the portal. Deletion covers the database, search vectors and files and produces a deletion certificate.
Questions from your privacy officer?
Send them. We answer security and privacy questionnaires in writing.