Security

Where we are

DIL and its products are in development with a small number of design partners, so this page describes our approach, not a certification. The controls for a deployment are confirmed with each design partner in writing, and that agreement takes priority over this page.

How the platform is built

• Deployment. Hosted by us, in your own cloud account, or on the floor for air-gapped sites, so the deployment can follow the site's requirements.
• Encryption. Data is encrypted at rest and in transit, with keys you can hold.
• Tenant isolation. DIL is multi-tenant by design, with isolation per tenant. Customer views show a customer only their own floor.
• Access. Single sign-on and roles connect to your identity provider and directories.
• Audit. Every write is attributed. Approvals, overrides and edits are kept, with who and when.
• Connectors. Each connection to a BMS, EPMS, DCIM, ITSM, finance or identity system has an owner, a mapping and a mismatch report.
• Your data. You can take full exports on demand.

Security reviews

We expect operators, especially sovereign and regulated sites, to review us closely. We don't list certifications on this page. If your review needs specific attestations, questionnaires or architecture detail, email hi@dhiya.ai and we will tell you where we stand.

This website

• The site is mostly static pages, with one server route for the contact forms.
• It has no user accounts or payments, and takes no product or customer data.
• Traffic is served over HTTPS.
• Form submissions are passed on by email. The site doesn't keep them in a database of its own.

Our privacy policy explains what the site collects and which providers process it.

Report a vulnerability

If you think you have found a security issue in dhiya.ai or a Dhiya product, email hi@dhiya.ai with "Security" in the subject line. Include the affected address or component, the steps to reproduce it and the impact you expect. We aim to acknowledge reports within two working days and will keep you informed as we investigate.

When you research an issue, please:

• Test only as far as you need to demonstrate the issue.
• Don't access, change or keep data that isn't yours. If you reach any by accident, stop and tell us.
• Don't run denial-of-service tests or social engineering, and don't touch any customer's site or systems.
• Give us reasonable time to fix the issue before you share it publicly.

We won't pursue legal action against anyone who researches and reports in good faith within these guidelines. We don't currently run a paid bug bounty.