Careful by default.
Open about it.
Your customers trust you with their details. This is how Dazza looks after them: where data lives, who can see it, and what the AI can and can’t do.
Principles,
not promises.
Each of these is how Dazza works today, not a plan.
Your data stays yours
Knowledge, conversations, files customers send (photos, screenshots, PDFs) and corrections live in your workspace and only ever answer your customers.
No training on your content
Our AI provider, Anthropic, is not allowed to train its models on your content under its commercial terms. Neither do we. If you use your own model provider, its terms apply.
Rules enforced in code
Confirmations, approvals, verification and decisions are checked by the system before anything runs, not left to the AI.
Instructions can’t sneak in
Text in your knowledge, a customer’s message or a file they send is treated as information. It can’t change Dazza’s rules or tools.
Secrets stay on the server
Webhook and sign-in secrets are never shown to the AI, and only appear in full to the admins who set them.
Proof, not guesswork
Customers prove who they are with an email code, your site’s signed login or a sender check, before account workflows run.
Your sites only
List the websites your chat may appear on, and it won’t load anywhere else.
The right people
Admins change the agent and settings. Members look after customers. Everyone signs in individually, with Google or a password.
Careful sign-in
Passwords are stored as scrypt hashes, never in plain text. Anyone can turn on two-step verification with an authenticator app. Email addresses are checked with a code, repeated wrong guesses are slowed down, and you can sign out other devices from your account.
A record of changes
Publishing, takeovers, approvals, emails and settings changes are recorded with who did them and when.
Every company
that touches your data.
The services Dazza runs on, what each one does, and where. Rows marked Optional are services you choose and use on your own accounts.
| PROVIDER | WHAT FOR | WHERE |
|---|---|---|
| Vercel | Runs the Dazza app and the chat. Also serves this website. | United Kingdom (London) for the app |
| Neon | The database that stores workspaces, knowledge, conversations and the files customers send, on AWS. | United Kingdom (London) |
| Anthropic | The AI model that reads your knowledge and writes replies. | United States |
| Resend | Sends and receives email, including replies from your own domain. | United States; your own domain sends from Ireland |
| Your own model provider | Optional, on Growth and above: writes replies instead of Anthropic, under your agreement with it. | Wherever that provider runs |
| Meta, Twilio, Telegram, LINE and Viber | Optional: carry messages on the apps you connect, using your own accounts with them. | Each provider’s own regions |
| Slack | Optional: receives the alerts you turn on, in the channel you choose, under your own agreement with Slack. Not our sub-processor. | Slack’s own regions |
Your workspace data, including files customers send, is stored in London. To write a reply, the conversation, its files and the relevant knowledge are sent to the AI model, which runs in the United States. Enterprise plans can arrange another data region.
Verified before
anything personal.
Workflows that touch a customer’s own account can require proof first. Dazza asks for a six-digit code sent to their email, accepts a login signed by your site, or trusts mail whose domain vouches for the sender.
- Codes are stored hashed, expire in 10 minutes and are rate-limited
- Verification lasts 12 hours
- Your system is told how the customer was verified
Where is our data stored?
In London: the Dazza app runs there and the database, which also holds the photos and PDFs customers send, is hosted on AWS there. To write each reply, the conversation, its files and the relevant knowledge are sent to Anthropic’s model in the United States. Enterprise plans can arrange another data region.
Who can open the files customers send?
Your team, signed in to your workspace, and the customer, in their own chat. Each file is checked from its contents before it’s kept, and it’s deleted with its conversation.
Who is responsible for our customers’ data?
You are, as the controller. Dazza processes it on your behalf, to answer your customers and run your workflows, under our data processing agreement, which applies on every plan. Enterprise plans can agree their own terms.
Is Dazza GDPR compliant?
Dazza is built to help you meet UK and EU GDPR: your workspace data is stored in London, our data processing agreement applies on every plan, our sub-processors are listed above, and you can find, export and delete a customer’s data yourself. As the controller, you decide what Dazza collects and tell your customers how it’s used.
Can we have our data exported or deleted?
Yes. Find a customer in Contacts to export their data or erase it for good, set how long conversations are kept, and remove knowledge and settings yourself at any time. Ask us to export or delete your whole workspace.
Do you have SOC 2 or ISO 27001?
Not yet. We’d rather tell you exactly how Dazza works than show a badge we haven’t earned. Ask us anything.
How do I report a security issue?
Please contact us with the details. We’ll reply quickly and keep you updated.