Security & Data Protection

Last updated: 25 September 2026

Your data stays yours. Organisations that use DGM One control their data. Emfara processes it only on their instructions, as their processor under data processing terms that meet Article 28 of the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection. DGM offices can request these terms at privacy@emfara.com.

Where data is hosted. DGM One is hosted in the United States. Transfers from the EEA, the UK and Switzerland rely on the EU standard contractual clauses, the UK International Data Transfer Addendum and the Swiss adaptations, not on the EU-US Data Privacy Framework. Our providers are listed on the Sub-processors page.

How we protect it.Data is encrypted in transit. At rest it is encrypted by our managed database and object storage providers, under their own key management; we hold no separate application layer encryption and we do not offer customer managed keys. Each organisation's data is isolated from every other organisation's, and that isolation is gated by a suite of 135 cases in our CI. Access by our staff is limited to people who need it to provide, support or secure the service, under confidentiality commitments.

Changes to our providers.We give customers at least 30 days' notice of a new sub-processor, and customers can object.

Breaches.If a personal data breach affects a customer's data, we notify the customer without undue delay and in any event within 48 hours of becoming aware of it.

Deletion.We delete data on a customer's instruction within 30 days. When an agreement ends, we delete the customer's data within 30 days, or after returning it if the customer asks, and it rolls off our database backups 7 days later. A small number of provider copies, such as backups, are kept for limited periods set out in our data processing terms.

AI features. AI output in DGM One is assistive: a person reviews and signs every determination the service records. Our AI provider, Anthropic, may not train models on customer content, and neither do we. Our AI assistants tell users they are interacting with an AI system.

Government requests. We review every request from a public authority for its legality, challenge it where there are reasonable grounds, notify the customer where we lawfully can and disclose only the minimum required.

What we have not built yet

We would rather you hear this from us than find it out. DGM One has no SOC 2 or ISO 27001 certification, no independent penetration test to date, no multi-factor authentication, no enterprise SSO or SCIM, no EU data residency, and no published vulnerability disclosure programme. Each is planned; ask us for current status and we will give you the real one.

Reporting a vulnerability

Please report security vulnerabilities to security@emfara.com. We aim to acknowledge reports within one business day. When testing, do not access or change data that is not yours, do not disrupt the service, and give us reasonable time to fix the issue before you publish it. We will not take legal action against research carried out in good faith within these rules.