Security and data handling

Answers for your security review

How devlin.ai protects simulation content and learner conversations, in plain language, for your security, IT, and governance teams.

Visit the Trust CenterContact security

SOC 2 Type 2

Independently audited against the Security Trust Services Criteria. The report is available under NDA through our Trust Center.

No training on your data

Our AI providers operate under no-training terms. Simulation content and learner conversations are not used to train models.

US hosting

The application, database, and AI serving run in United States regions.

Tenant isolation in the database

Row-level security in Postgres keeps each customer's data separate, enforced by the database itself, not only by application code.

Encrypted in transit and at rest

TLS 1.2+ with HSTS for every connection, and AES-256 encryption at rest.

Enterprise single sign-on

Connect your own identity provider over SAML, such as Microsoft Entra ID or Okta, and require SSO for your whole organization.

Minimal learner data by design

devlin.ai stores what a simulation needs to run and what a designer needs to review it. Nothing more.

Learner sessions are anonymous by default

Each learner session gets a random identifier. Learner identity collection is off unless a workspace owner or admin turns it on, and identity values are never included in AI prompts.

Voice audio is never recorded

In voice simulations, speech is processed in real time and never recorded or stored, by devlin.ai or by our voice provider. The text transcript is stored like any other conversation.

Designed for synthetic training content

devlin.ai is built for practice scenarios that instructional designers write. It is not designed to process patient data, customer records, or other regulated data.

Deletion on request

Designers can request export or deletion of their data. Account deletion removes simulations, conversations, messages, and credit history.

Security controls

  • Server-side authentication on every non-public route
  • Public endpoints are rate limited and validate every request before acting on it
  • Learner input is screened before it reaches the AI model
  • Per-simulation daily spending caps
  • Hosted course files are served from a separate, isolated origin
  • Staging and production use fully separate databases
  • Every code change passes type checks, linting, and tests before release
  • Infrastructure and security logs retained for 365 days

Subprocessors

Vercel
Application hosting
Supabase
Database, authentication, backups, file storage
Anthropic
AI model (Claude) for simulations, coaching, and evaluations
AWS (Bedrock)
AI model (Claude) serving and knowledge base embeddings
ElevenLabs
Voice, only for voice-enabled simulations
Stripe
Payments (no card data touches devlin.ai)
Upstash
Rate limiting
Axiom
Infrastructure and security log retention

Each subprocessor maintains its own security program. The current list with links to their trust centers is available on request.

Frequently asked questions

Is devlin.ai SOC 2 compliant?

Yes. devlin.ai has completed a SOC 2 Type 2 audit covering the Security Trust Services Criteria, performed by Sensiba, an independent audit firm, with an unqualified opinion. The report is available under NDA through our Trust Center.

Is our data used to train AI models?

No. Simulations, coaching, and evaluations run on Anthropic Claude models through Anthropic's commercial API and AWS Bedrock, both under no-training terms. API inputs and outputs are not retained or used to train models by either provider, and we do not opt in to any data-sharing arrangement that would change this.

Where is our data stored?

In the United States. The application, database, and AI serving run in US regions of Vercel, Supabase, and AWS Bedrock.

What learner data does devlin.ai collect?

By default, none that identifies the learner. Each session gets a random identifier and the conversation transcript is stored so designers can review it. A workspace owner or admin can turn on optional learner identity collection, and those values are never included in AI prompts. Learners can type anything into a conversation, so we recommend advising them not to enter real personal or sensitive information.

Can we use devlin.ai for healthcare training?

Yes, with synthetic scenarios. devlin.ai is not designed to process Protected Health Information and does not offer a Business Associate Agreement. Soft-skills and communication practice built on synthetic content typically keeps devlin.ai outside the scope of HIPAA.

Do you support single sign-on?

Yes. Enterprise organizations can connect their own identity provider over SAML, such as Microsoft Entra ID or Okta, and require SSO for all members. devlin.ai also supports Google, Microsoft, and emailed one-time code sign-in, and does not manage passwords.

Will you complete our security questionnaire or sign a DPA?

Yes. We enter into Data Processing Agreements with enterprise customers as part of contracting, and we complete standard vendor security questionnaires, including CAIQ and SIG Lite.

What happens if there is a security incident?

We identify and contain the affected scope, notify impacted customers directly within 24 hours of confirmation, and provide a written post-incident summary with root cause and remediation steps.

Running a vendor review?

Request the SOC 2 Type 2 report and our detailed security overview through the Trust Center, or email devlin@devlin.ai for questionnaires and DPAs.

Visit the Trust CenterSee plans