# Data, Privacy, & Security

At Delphi, protecting your data is foundational to how we build and operate our platform. This page provides a high-level overview of our practices. For the full legal details, please refer to our [Terms of Use](https://www.delphi.ai/terms), [Creator Terms of Use](https://www.delphi.ai/terms-creator), [Privacy Policy](https://www.delphi.ai/privacy), and [Biometric Consent](https://www.delphi.ai/biometric-consent).

#### Content Ownership

You maintain full ownership of all content you upload to create your Digital Mind. Your intellectual property remains exclusively yours. Creator content is stored in its own private index and is not shared or used to train any external models.

#### **Data Protection Measures**

* **Encryption:** When data travels over the internet (e.g., when you log in or send a message), we encrypt it using TLS 1.2+. All stored customer data is locked and encrypted.
* **Daily Backups:** We save copies of our data every night, so if anything goes wrong, we can restore lost information.
* **Private Subnet (Data Isolation):** Customer data is processed in a private, separate section of our cloud environment that cannot be accessed by the public internet.
* **DDoS Protection (Defending Against Attacks):** We use Cloudflare and AWS Shield to protect against attacks that use excessive traffic.
* **Web Application Firewall (WAF):** This system monitors and blocks harmful internet traffic, preventing threats before they reach our platform.

**Monitoring and Compliance**

* **Automated Security Monitoring:** We use tools like [Sentry.io](http://sentry.io), Axiom, and Logfire to continuously check our system’s health. If anything unusual happens, an alert is sent to our security team immediately.
* **Audit Logs:** Every action in our system is recorded using AWS CloudTrail, ensuring a clear record of who accessed what, when, and why.

**Application Security:** 

* **Penetration Testing:** Delphi has yearly penetration tests to ensure our security standards. If any weaknesses are found by expert security testers, they are fixed immediately.
* **Vulnerability Scanning:** We use tools like Snyk and AWS GuardDuty to scan for weaknesses in our system and update any outdated security measures before they become a risk.

**Secure Access and Identity Protection**

* **Role-Based Access Control (RBAC):** Employees and system users only get access to the data they need.
* **Credential Management (Protecting Passwords and Secrets):** We use AWS Key Management Service (KMS) and 1Password to securely store passwords and secret access keys, ensuring they’re encrypted and only accessible to authorized people

#### Biometric Data

When Creators upload audio or video recordings to generate their Digital Mind, Delphi may derive limited biometric information (such as voiceprints) from that content. Full details are in our [Biometric Consent](https://www.delphi.ai/biometric-consent) Form. 

#### Incident Response

If a security event occurs, we follow a structured protocol:

* **Incident Response Plan:** Our team follows a defined process to detect, analyze, and respond to security issues immediately.
* **Root Cause Analysis (Preventing Recurrence):** After any security event, we investigate what caused it and take steps to ensure it doesn't happen again.

#### Further Rights

Depending on where you live, you may have rights to access, correct, delete your personal data. EU/UK residents have additional rights under GDPR. For full details on what rights apply to you and how to exercise them, see our [Privacy Policy](https://www.delphi.ai/privacy).

*For any questions related to privacy or security, please reach out to* [*support@delphi.ai*](mailto:support@delphi.ai)