Security

Security at Digitorn starts with a simple choice: how much of your data ever leaves your machine. Digitorn runs in three configurations and each one has a different footprint. Digitorn Cloud (digitorn.ai) hosts the agents and data for you. The local install with Gateway keeps the client and your data on your machine and routes only model and tool calls through Digitorn Gateway. The local install with BYOK turns the Gateway off, so model calls go straight to the provider with your own keys and we never see that traffic. Digitorn is open source, so you can also self-host the whole stack.

Data in transit and at rest

All traffic to Digitorn services is encrypted with TLS. On Digitorn Cloud, data at rest is encrypted by the underlying platform. In the local setups, your projects, conversations and files live on your own disk under your own operating-system permissions.

We don’t train on your data

We do not train models on your prompts, code, conversations or files, and we contractually require the model providers we route to through Gateway not to train on your content either. Your data is used to run the request you asked for, and nothing more.

What reaches model providers

To answer a request, an agent sends the relevant context (your prompt and the parts of the workspace it needs) to the model you picked with brain.model. Through Gateway, that call is proxied by Digitorn to the provider; with BYOK it goes directly. Which provider receives it is always the model you selected. Switch it any time in the manifest or with /model.

Access controls

Access to production systems follows least-privilege principles and is protected with multi-factor authentication. We keep system logs and monitor for anomalous activity. Sign-in uses your Google or Microsoft identity; we never see or store your provider password.

Infrastructure and sub-processors

Digitorn Cloud runs on reputable cloud infrastructure. We use a small set of sub-processors for hosting, authentication and the model providers you route to. Model providers only receive the content of the requests you make to them.

Account and data deletion

You can delete your account from your settings at any time, which removes your account data. In the local setups, deleting the data is as simple as removing the files from your machine.

Reporting a vulnerability

If you believe you’ve found a security issue, please email security@digitorn.ai. We aim to acknowledge reports within five business days and will keep you updated as we investigate. Please give us a reasonable window to address an issue before any public disclosure.