Security

Security at Digitorn starts with a simple choice: how much of your data ever leaves your workspace. Digitorn Cloud (digitorn.ai) hosts the agents and data for you, encrypted in transit and at rest. Because Digitorn is open source, you can also self-host the whole stack: the client and your data stay on your own machine, routing model and tool calls through Digitorn Gateway, or with bring-your-own-key straight to the provider so we never see that traffic.

Data in transit and at rest

All traffic to Digitorn services is encrypted with TLS. On Digitorn Cloud, data at rest is encrypted by the underlying platform. In the local setups, your projects, conversations and files live on your own disk under your own operating-system permissions.

We don’t train on your data

We do not train models on your prompts, code, conversations or files, and we contractually require the model providers we route to through Gateway not to train on your content either. Your data is used to run the request you asked for, and nothing more.

What reaches model providers

To answer a request, an agent sends the relevant context (your prompt and the parts of the workspace it needs) to the model you picked in Studio. Through Gateway, that call is proxied by Digitorn to the provider; with BYOK it goes directly. Which provider receives it is always the model you selected. Switch it any time in Studio or with /model.

Access controls

Access to production systems follows least-privilege principles and is protected with multi-factor authentication. We keep system logs and monitor for anomalous activity. Sign-in uses your Google or Microsoft identity; we never see or store your provider password.

Infrastructure and sub-processors

Digitorn Cloud runs on reputable cloud infrastructure. We use a small set of sub-processors for hosting, authentication and the model providers you route to. Model providers only receive the content of the requests you make to them.

Account and data deletion

You can delete your account from your settings at any time, which removes your account data. In the local setups, deleting the data is as simple as removing the files from your machine.

Reporting a vulnerability

If you believe you’ve found a security issue, please email security@digitorn.ai. We aim to acknowledge reports within five business days and will keep you updated as we investigate. Please give us a reasonable window to address an issue before any public disclosure.