How DICE protects your customers’ data
What we do today, who processes data for us, and the documents your legal team will ask for. Our legal documents are drafts until our counsel finishes the review.
Security practices in place
Isolation per business
Row-level security in PostgreSQL on every tenant table, covered by an automated isolation test suite.
Encryption
TLS for all traffic. Secrets use envelope encryption. Backups are encrypted before they leave the database server.
Access control
Role-based permissions, mandatory two-factor authentication for DICE staff, four-eyes approval for dangerous actions.
Audit trail
Append-only, hash-chained audit log for staff and system actions, verified nightly.
Impersonation rules
Staff can view a customer account only with a stated reason, for a limited time, with a notice to the customer.
Tested recovery
Nightly backups and an automated weekly restore test with row-count checks.
Data location
Customer data is stored in DICE’s production database. When the agent writes a reply, the relevant text goes to the AI model provider configured for that request. Each provider and the region it processes data in is listed below. Businesses that need a specific region can ask about data residency on the Pro and Enterprise plans.
Documents
- Privacy policy
- Terms of service
- Cookie policy
- Acceptable use policy
- Service level agreement
- Data processing agreement (DPA)
- Responsible AI statement
Report a vulnerability
See /.well-known/security.txt for the security contact. Please give us a reasonable time to fix an issue before you disclose it.
Sub-processors
Services that may process personal data on our behalf. Several are used only when the related feature or integration is turned on.
| Service | Purpose | Data | Location | When used |
|---|---|---|---|---|
| Anthropic | AI model provider for agent replies and reports | Conversation text, Business content | USStandard contractual clauses | Default AI provider |
| Voyage AI | Embeddings and reranking for knowledge search | Business content, Customer questions | USStandard contractual clauses | Default embedding provider |
| OpenAI | Alternative AI model provider | Conversation text, Business content | USStandard contractual clauses | Only when enabled as a fallback or chosen route |
| Google (Gemini) | Alternative AI model provider | Conversation text, Business content | US, EUStandard contractual clauses | Only when enabled as a fallback or chosen route |
| Stripe | Subscription payments and booking deposits | Billing contact, Payment details (held by Stripe) | US, IEStandard contractual clauses | When paying by card through Stripe |
| Iyzico | Payments in Turkey | Billing contact, Payment details (held by Iyzico) | TR | When paying through Iyzico |
| PayPal | Payments | Billing contact | US, LUStandard contractual clauses | When paying through PayPal |
| Meta Platforms | WhatsApp, Instagram and Messenger messaging | Phone number or account id, Messages | US, IEStandard contractual clauses | When a business connects these channels |
| Twilio | SMS and voice | Phone number, Messages | USStandard contractual clauses | When configured as the SMS or voice provider |
| Cloudflare | Bot protection on public forms (Turnstile) | IP address, Browser signals | US, GlobalStandard contractual clauses | When Turnstile is configured |
| Google (Calendar) | Calendar availability and bookings | Appointment details | US, GlobalStandard contractual clauses | When a business connects Google Calendar |
| Microsoft (Outlook Calendar) | Calendar availability and bookings | Appointment details | US, EUStandard contractual clauses | When a business connects Outlook |
Common questionnaire answers
Is DICE certified?
Not yet. We describe the controls that are built into the product today and do not claim certifications we do not hold.
How is my customers’ data separated from other businesses?
Every tenant row carries its business id, and PostgreSQL row-level security filters every query. An automated isolation test suite runs on every build.
Can DICE staff see my conversations?
Only through time-limited, logged impersonation with a stated reason, and you receive a notice when it happens.
Can we sign a DPA?
Yes. Our data processing agreement is published in the trust center and forms part of the terms.
How do we handle a deletion request from one of our customers?
Use the privacy tools in the portal. Deletion covers the database, search vectors and files and produces a deletion certificate.