Commitments
Five commitments, in writing.
- Your data never trains models. Off by default at the workspace level, contractual on request.
- Nothing irreversible without human approval. Draft-never-send is architecture, not a setting.
- Every action is logged. Immutable audit trail, retained and exportable.
- Deletion is real. Vectors and derived indexes included, with a destruction certificate.
- SOC 2 Type II audit in progress. Full security overview available to prospective customers under NDA.
Sovereignty
Your data never leaves the deployment you choose.
On your infrastructure
domayne runs on servers you control: your data centre or your cloud tenancy. Inference happens inside your own jurisdiction on private models. No conversations, documents or company data are sent to any external AI provider.
Hosted, still sovereign
We host the workspace on isolated, dedicated infrastructure with data residency where you need it. You choose the models, private, open or frontier, and the intelligence layer stays yours either way. Change the model, keep the intelligence.
Controls
Six controls, enforced in the platform, not in policy documents.
Tenant isolation, enforced by the database
Row-level security makes the database boundary itself enforce isolation. One company's data is structurally invisible to another, not filtered out by application code.
Deny by default
Sensitive capabilities are explicitly granted, never implicitly available. Every connector is permissioned per role: leasing sees leases, finance sees finance.
Draft-never-send
Every outbound side effect is a proposal a person approves, framed as a decision with full context, not a naked confirmation box. Nothing consequential happens on Nova's own authority.
Immutable audit trail
For any run: what data was retrieved, what tools were invoked, what was produced, answerable without reconstructing logs, retained and exportable.
Hard delete, proven
Deletion includes vectors and derived indexes, not just rows. One-click export of everything you own, and a destruction certificate when you leave.
Budgets and kill switches
Every autonomous run is bounded in steps, tokens and time. A runaway is stopped, not continued. A kill switch halts the workspace immediately.
Blast radius
Every action is tiered by consequence, never by confidence.
The gate is what an action can reach, not how sure the model feels. Autonomy scales only where reversal is possible.
Read
Nova reads freely within its granted scope. Reversible by definition.
Draft
Nova writes drafts and working documents inside the workspace. Reversible, logged.
Reversible external
Actions with an undo, such as calendar holds and internal updates, run with automatic logging.
Irreversible external
Send, delete, pay: always waits for an explicit, well-framed human decision. Always.
Privileged
High-blast-radius operations require approval plus a second judgment before anything moves.
Compliance
Compliance by construction. SOC 2 in progress.
domayne is built for organisations that answer to data protection law. Inference and storage inside your own jurisdiction mean personal information is never routed through an external API to answer a question. Audit logging, role boundaries, hard deletion and export exist so that your own compliance obligations are practical to meet, not theoretical.
A SOC 2 Type II audit is in progress as the platform matures toward external scale. Our security overview, covering architecture, data flows, sub-processors and model policy, is available to prospective customers under NDA.
Model policy
Your data is never used to train models by default. Optional fine-tuning on anonymised internal conversations exists as a workspace-level control that is off until an administrator turns it on, and it never leaves your deployment.
Reporting a vulnerability
We take reports seriously and respond quickly. Write to security@domayne.ai.