Security

We treat security as a first-class concern — not an afterthought. Product decisions, infrastructure choices and data handling practices are evaluated through a security lens. Our team follows a defence-in-depth strategy, layering controls rather than relying on any one of them.

All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. Conversation and contact data is stored in Supabase, which encrypts customer data at rest with AES-256. Data on our own servers is protected by the hosting provider's ISO 27001-certified infrastructure and by host-level controls rather than by disk encryption.

• TLS 1.2 or higher on every API call, in both directions.
• Secrets and API keys live in the automation platform's encrypted credential store, never in source code.

Access controls on our internal systems and customer-facing services:

• Access to each system is granted per person and per role.
• Multi-factor authentication is enabled on our hosting control panel.
• Personnel are granted only the access their role needs.
• Administrative access is logged.

Our servers run on ISO 27001-certified hosting infrastructure (Hostinger); conversation and contact data is stored in Supabase, which holds SOC 2 Type 2 and ISO 27001 attestations. These certifications belong to those providers, not to DigitLab AI. Measures on our side:

• A host firewall allows only the ports the site and its automation need.
• The dependencies that ship to the browser are audited on every release (a high or critical advisory blocks it), and the host runs a malware-detection agent.
• Network-level DDoS protection from the hosting provider, and a bot challenge (Cloudflare Turnstile) on the chat and contact endpoints.

Our AI systems are designed with security and safety in mind:

• Guest-facing agents run with fixed instructions, bounded tools and human escalation.
• AI output is rendered as text, never as HTML.
• Model inputs and outputs are logged for review.
• We use model providers through their business APIs, whose terms exclude API data from training by default; the provider terms that apply to each engagement are agreed and documented per client.

When something goes wrong we detect it, contain it, fix it and write it up:

• Automated alerts on workflow errors and daily health checks, delivered to the operator's phone.
• Affected customers are notified promptly in the event of a breach that impacts their data.
• Post-incident reviews are conducted to identify root causes and prevent recurrence.

DigitLab.ai is committed to meeting applicable regulatory and industry standards:

• Operations align with UAE data protection regulations and international privacy standards.
• GDPR-aligned data handling practices for users in the European Economic Area.

We believe in working collaboratively with the security community. If you discover a potential vulnerability in our systems, we encourage you to report it responsibly.

Please do not exploit the vulnerability, access customer data, or disrupt our services. Instead, contact us directly and we will work with you to resolve the issue promptly.

Report security issues to: security@digitlab.ai

For any security-related questions or concerns, please reach out to our team: