The four questions your security review opens with.
Two of these answers are not the ones we would prefer to give. You will find them out either way — the only variable is whether you find them out from us.
Where is our data hosted?
In Europe.
The application, the database and file storage for documents and reports all run in EU regions. No customer data is stored outside the EU.
Does our data reach any third party?
Yes — the AI providers, under a no-training commitment.
This is the answer most vendors leave vague, so here it is plainly. Prompts are transmitted to our AI providers to be processed — that is how any AI feature works — and they may process them outside the EU under the standard contractual clauses governing those transfers. Your knowledge is not used to train their models, is never blended into another customer's knowledge base, and is deleted by them after a short retention window. Nobody else receives it.
Are you SOC 2 or ISO 27001 certified?
No. Certification is ahead of us, not behind us.
We would rather say so than imply otherwise. What is true today is verifiable in a technical review: tenant isolation enforced by the database rather than by application code that could forget, access tokens never written to browser storage, EU residency, and the no-training commitment above. We are glad to walk your team through any of it and to complete a vendor questionnaire.
Can we get our data out, and can we be forgotten?
Export yourself; deletion is handled by us, on request.
Every analysis exports as an audit-ready PDF with its traceability chain, and each user can export their own record — incidents, sessions, corrective actions — as structured data, without asking. Account and tenant deletion is not self-service: it is a managed purge we run on request, precisely because an irreversible action on a multi-user workspace should not sit behind one button.
Sessions, tenant isolation and data handling in full — read the security FAQ →
Multi-tenant by construction
Your data is isolated at the data layer with Row-Level Security — not by application logic alone. One tenant can never see, query, or influence another’s knowledge.
Nothing is quietly destroyed
A closed incident cannot be deleted, and neither can one carrying a completed analysis — they are retired, never erased. Master-data changes are versioned append-only, enforced by the database itself. Merging two records that look like duplicates needs a named human approver.
Not locked in
Every analysis exports as an audit-ready PDF with its traceability chain, and each user can export their own record as structured data without asking. Deletion is a managed purge we run on request rather than a self-service button. Demo data is always watermarked as demo data.
Sessions that cannot be stolen from the browser
Access tokens live in memory only — never in browser storage, so a cross-site script has nothing to read. They expire within the hour and refresh against an HTTP-only cookie; logging out invalidates that cookie on the server, not just in the tab. Data is encrypted in transit and at rest.
Five roles, mapped to how a plant works
Admin, supervisor, engineer, reviewer and operator — governing who can view, author, approve and sign off, mapped to how your sites and quality functions are actually organized rather than to a generic permission matrix.
Used to serve you, and no one else
Your operational knowledge is never blended into another customer’s and never repurposed beyond the scope you agree to. It is processed by our AI providers under a no-training commitment — stated in full above — and by nobody else.
Your knowledge is yours.
The whole premise of DatumKeep is that your organization’s hard-won experience is a compounding asset. We treat it that way: isolated at the data layer, retired rather than erased, exportable, and never used against the interests of the organization that created it.