What DAC reads, what DAC
doesn't, and how DAC
handles your data.
Last updated: May 2026
Public surfaces
Connected stack (OAuth, opt-in, revocable)
What DAC reads inside your connected stack
Stored in Turso. Primary region: US. Encrypted at rest (AES-256) and in transit (TLS 1.3). Backed up nightly. Retained for the duration of your account plus 30 days.
Permanently deleted on request. Full deletion within 14 days of request. See /privacy for the full data handling policy.
LLM provider for scoring: Anthropic Claude. DAC sends compact metadata to the scorer. We do not send customer-identifying signals beyond your tenant ID.
For procurement teams: bring your security questionnaire. We respond within 5 business days.
If you need a control that isn't listed here, email hello@dacard.ai. We will tell you whether it exists, when it ships, or that we will not build it.
Talk to us about enterpriseWe rely on the following services to operate DAC. Each processes data on our behalf under a data processing agreement.
| Subprocessor | Purpose | Data handled | Attestations |
|---|---|---|---|
| Anthropic | LLM inference for scoring and coaching | Prompts, cited URLs, conversation content | SOC 2 Type 2 |
| Clerk | Authentication and session management | Email, name, session tokens | SOC 2 Type 2 |
| Turso | Database hosting | Account data, scores, signals | SOC 2 in audit, ISO 27001, HIPAA, PCI DSS |
| Vercel | Web hosting and edge CDN | Request metadata, IP, logs | SOC 2 Type 2 |
| Stripe | Payments and billing | Billing identifiers (no card numbers) | PCI DSS Level 1, SOC 1, SOC 2 |
| Resend | Transactional email | Email addresses, message content | SOC 2 Type 2 |
| PostHog | Product analytics (consent required) | Event stream, user identifiers | SOC 2 Type 2 |
| Sentry | Error tracking (consent required) | Stack traces, browser context | SOC 2 Type 2 |
Attestations are self-reported by each vendor and current as of the last updated date above.
Security issues: hello@dacard.ai with “Security:” as the subject prefix.
Privacy requests: privacy@dacard.ai
Dacard, Inc., Vancouver, BC, Canada.