Security and privacy at DLVR AI.
How we protect the systems we build and run for our clients, and the data inside them. For any document below, or to have your security questionnaire completed, contact us.
One security baseline, on every system.
Every website, business system and AI solution we deliver is built, hosted and operated against the same set of controls, whether it is a single site or a full operating platform.
Our information security management system follows ISO/IEC 27001:2022, and our data handling follows the UAE Personal Data Protection Law and Canada's PIPEDA. The controls below are what that looks like in practice.
Frameworks and regulations we operate against.
Security controls.
Infrastructure & network security 06
All public traffic passes through Cloudflare's network before it reaches any system.
TLS 1.2 minimum, TLS 1.3 preferred, HSTS preloaded; plain HTTP is never served.
Servers do not accept connections from the open internet; administration runs over a private, authenticated network.
Client environments are isolated from each other and from internal systems.
Only the ports and services a system needs are open.
Public forms and APIs are rate-limited at the edge and in the application.
Data security 05
Databases and backups are stored encrypted.
Automated backups with an off-site copy, restore-tested on a schedule.
Where each client's data is hosted is agreed in writing before work begins.
Clients own their code, data and accounts, and can export everything in standard formats.
Data is kept only as long as needed, then deleted securely, under a written retention schedule.
Application security 06
Every change is reviewed against the OWASP Top 10 and CWE Top 25 before release.
Content Security Policy with Trusted Types, clickjacking protection and strict security headers.
Parameterised queries, server-side validation and authorisation checks on every request.
Keys and credentials are stored in a secrets manager, never in source code.
Minimal third-party code, kept current on a schedule.
Changes are tested on a copy of the system before they reach production.
Identity & access 04
No shared logins; every person and service has only the access it needs.
Required on hosting, DNS, code repositories, email and administrative systems.
Client staff receive roles matched to their job, not administrative rights.
Access is revoked the same day a person leaves or no longer needs it.
Operations & incident response 05
Availability, errors and security events are monitored, with alerts to the team.
Systems are patched on a schedule; critical vulnerabilities are fixed as a priority.
Production changes are versioned, reviewed and can be rolled back.
Clients are notified within 24 hours of a confirmed incident affecting their system or data.
Security-relevant events are logged and retained for investigation.
Organisational security 05
A documented policy set, approved by leadership and reviewed every year.
Risks are assessed, recorded in a risk register and treated.
Every provider that handles data is reviewed and recorded.
Everyone with system access follows the acceptable use policy and security training.
A tested plan for restoring service after a major disruption.
Policies and documents.
Available to clients and prospects on request.
Providers that support our services.
What we will and won't build.
No dark patterns, no AI that pretends to be a person without saying so, no fake reviews or fake urgency.
No scraping personal information, no hidden tracking, no selling or sharing of client or customer data.
Automation that sends people messages they didn't ask for, in any channel.
Including gambling, lending or financial products outside the licences they need.
Assistants say what they are. Outputs that matter — reports, money, compliance — are reviewed by a person before they go out.
We never use a client's data to train anything for anyone else. That's in the contract, not just on this page.