Data Processing Facts

No certifications (no independent security certification is held or in progress). No published uptime commitment (SLA). No regional data-residency option. No SSO/SCIM. No penetration-test report. No named data protection officer — privacy questions go directly to the contact address.

A customer who requires any of the above is not sold on the promise that it is coming.

For ACCOUNT data (who signed up, what was billed, support correspondence) DevAny is the CONTROLLER.

For data INSIDE a customer's generated apps (appointments, records, the app's own end users) DevAny is a PROCESSOR acting on the customer's instructions — that data belongs to the customer.

Generated-app end users are a separate identity domain: they never become DevAny organization members; a Team customer's own customers are not our users.

When a customer connects a third-party AI assistant to their account, the app data that assistant requests is delivered, on the customer's instruction, to the provider the customer chose; that provider is not a DevAny subprocessor (Privacy Policy §6).

Every textual generation goes through ONE gateway — Vercel AI Gateway (Vercel Inc., US); there is no silent rerouting — if the gateway is unavailable the request fails with a stated reason. When the customer picked a model and the chain fell back, the model that ran instead is named by canonical id together with the reason; on Auto the model is the platform's decision.

The gateway forwards each request to the developer of the selected model or to a host that serves it. Most requests, defaults and Auto use Anthropic, OpenAI and Google models; a customer may also pick models from other developers, and some platform steps (the multi-model council, translation, fallback chains) use them too. The full list is on the Subprocessors page; some of these developers are established outside the US and the EU.

We do NOT train models on customer data: DevAny operates no training pipeline, does not opt customer content into training and has no mechanism to do so. Vercel's and the model providers' own terms apply to what passes through the gateway.

Prompts and outputs are stored in your own account so you can see history and restore versions.

Row Level Security on the database; the application layer deliberately holds no privileged key — privileged operations happen only in audited server functions.

Generated apps run inside a sandboxed iframe and are never injected into the platform interface.

Admin consoles sit behind device-verified Zero Trust access, and each door accepts only its own identity.

Data is encrypted in transit and at rest. A daily database backup is encrypted and written to Cloudflare R2; a copy of media and uploads is kept in the same private bucket. Backup jobs and the daily restore drill run on GitHub Actions.

Server errors are sent to Sentry; before sending, request bodies, cookies and headers are dropped, the user is reduced to an id, and email- or key-like text is masked.

The maintained subprocessor list is on the Subprocessors page; a new service touching customer data is added there in the same change.

When an account is deleted, account, app and content data are removed; only invoice/transaction records that must legally be kept are retained for their statutory periods. Personal-data rights requests are answered within 30 days at the latest.