Deem is an AI-powered customer success platform. Our customers trust us with some of their most sensitive business data — customer communications, CRM records, and product usage. This page describes how we protect it.
EU Data Residency
Customer data is stored and processed within the European Union as described in the applicable Agreement, DPA and transfer documentation.
- Infrastructure: AWS eu-central-1 (Frankfurt, Germany)
- Database: MongoDB Atlas, deployed in eu-central-1
- AI inference: AWS Bedrock, called from eu-central-1 through EU-only inference profiles — customer data is processed in the EU region for AI inference, subject to the applicable provider configuration and transfer safeguards
- Encryption keys are created and managed within the EU region
- The platform is architected for regional isolation, supporting additional data-residency regions as customer requirements demand
AI Data Use
- No training on customer data. Customer data is used for inference to provide the Service. Neither Deem nor its AI model providers train, fine-tune, or improve general-purpose AI models on customer data, as configured and contractually agreed with the relevant providers.
- Limited model-provider retention. Model providers are configured and contractually required not to use customer content for training, and to retain customer content only where necessary to provide, secure, monitor abuse of, or comply with law in relation to the Service.
- Explainability by design. AI-generated assessments and agent actions carry traceable reasoning, and every automated action is recorded in an audit trail.
- Human oversight. Customers control agent autonomy, from human-approval-required to autonomous, with platform-enforced guardrails (rate limits, cooldowns, duplicate suppression).
Architecture & Isolation
- Multi-customer architecture with logical data isolation per customer, enforced on every request and query
- Staging and production run in separate AWS accounts
- Databases accept connections only from the production network, and storage buckets block all public access
- All infrastructure is defined as code, version-controlled, and auditable
Encryption
- In transit: TLS for all external communication
- At rest: AES-256 for databases, object storage, and backups
- Secrets: AWS Secrets Manager; credentials never stored in code or configuration
Access Control
- SSO with enforced MFA for all production access
- Role-based, least-privilege permissions; production admin access is time-limited and restricted to named individuals
- No standing credentials: CI/CD authenticates via short-lived OIDC federation; no stored cloud keys
- Access reviews and immediate revocation on personnel changes, per our Onboarding/Offboarding Policy
Operational Security
- Centralized logging and monitoring of system and administrative activity, with alerting on service health and anomalies
- Change management: peer-reviewed pull requests and automated CI/CD; no direct production changes
- Backup & disaster recovery: continuous database backup with point-in-time recovery (target RPO: 10 minutes for critical data), automated snapshots, defined recovery objectives (target Tier 1 RTO: 4 hours), and restore testing at least annually
Incident Response
- Documented procedures with severity classification, escalation paths, and post-incident review
- Breach notification: affected customers are notified as soon as possible and in any case no later than seventy-two (72) hours after Deem becomes aware of a personal data breach, including the nature of the breach, affected data categories, likely consequences, and mitigation measures — enabling customers to meet their own obligations under GDPR Articles 33–34
Compliance Program
- GDPR: Deem acts as data processor for customer data, on documented instructions. An Article 28-compliant Data Processing Agreement is available to all customers.
- Policy suite: Security, Data Privacy & Retention, Incident Response, Risk Management, Vendor Management, Backup & Disaster Recovery, Acceptable Use, Change Management, Onboarding/Offboarding.
- SOC 2: Type 1 audit targeted for Q4 2026, followed by a Type 2 observation period. Reports will be available to customers upon request.
- Penetration testing: the first independent penetration test of the Deem platform is scheduled for Q4 2026. Until then, all code changes go through security review and the platform is covered by automated vulnerability scanning. After that, independent penetration testing is performed at least annually. A summary of results is available to customers on request.
- We monitor regulatory developments applicable to AI systems, including the EU AI Act, and design our transparency and oversight controls accordingly.
Data Lifecycle
- During service: customers control what is connected and can disconnect integrations at any time
- On termination: customers may export customer data during the export window agreed in the Agreement; where mandatory EU Data Act switching obligations apply, Deem provides assistance as required. Deletion and backup removal follow the Agreement and DPA.
- Data subject rights: supported through the customer (controller), with Deem assisting per the DPA
Responsible Disclosure
Report suspected vulnerabilities to security [at] deem.inc. We acknowledge reports promptly, investigate in good faith, and will not pursue legal action against good-faith research conducted within reasonable bounds.
Contact
Security: security [at] deem.inc · Privacy: privacy [at] deem.inc · DPA requests: legal [at] deem.inc