The short answer: we do not hold your content.
Data.co Control runs inside your infrastructure. Prompts, documents, embeddings, records, and audit logs stay there. Our hosted service, app.data.co, handles accounts, licensing, billing, and opt-in administration. This page explains that boundary and links to the details.
Who processes what.
| Data | Where it lives | Data.co access |
|---|---|---|
| Prompts, responses, documents | Your deployment | None, unless you grant support or managed services access |
| Embeddings, indexes, model weights | Your deployment | None by default |
| Audit logs | Your deployment | None; you choose where to export |
| Account and contact details | app.data.co | Processed to provide the service |
| License and billing records | app.data.co and payment processor | Processed to provide the service |
| Marketplace API usage | Data.co Marketplace | Request metadata for metering and abuse prevention |
Where to find the details.
Security
Our product security model, how we secure app.data.co, and how to report a vulnerability.
Compliance
Which frameworks we design to support and the status of any audits or attestations.
Privacy policy
How we handle personal data in our own services.
Subprocessors
Third parties that process data on our behalf for app.data.co and the Marketplace.
Data processing addendum
Contract terms for customers who need a DPA.
Dataset licensing
How Marketplace datasets are licensed and what rights transfer.
Third-party audit reports: not yet published.
Data.co has not yet published a SOC 2 report, ISO/IEC 27001 certificate, or other third-party attestation. Status will be posted here. Because the product runs in your environment, much of the relevant control evidence comes from your own deployment and its audit log.
What we commit to in how we build.
- Content processing stays in customer infrastructure
- Telemetry beyond licensing is opt-in
- Deployments run without outbound connectivity
- Customer data is not used to train any model
- Material changes to data handling are announced on this page
- Security reports are acknowledged and tracked
Claims you can check without taking our word.
Because the runtime runs in your environment, most of what matters can be tested by your own team.
Outbound traffic
Run the runtime on an internal-only network. It needs no route out to make decisions, and its status endpoint lists every allowed egress destination and recent attempts.
Audit integrity
Verify the hash chain online or offline with the runtime's own command. Any edited, removed, or reordered record breaks verification.
License behavior
Inspect the signed license file and verify it against the published public key. Editing any field invalidates the signature.
Image integrity
Compare release archives against their published SHA-256 checksums before loading them, including across an air gap.
Policy behavior
Run your own test cases against the policy engine, or use the access simulator to see which rule decided a request and why.
Telemetry content
If you opt in to the heartbeat, capture it: the body is limited to version, license status, health, components, and policy set version.
How to run your security review of Data.co.
- 1
Start with the boundary
Read the data handling table above and the security model. Most questionnaire sections on data storage and processing are answered by where the runtime runs.
- 2
Request documents
Ask through the contact page for the draft data processing addendum, the subprocessor list, and answers to your questionnaire.
- 3
Test a pilot
Install the runtime in a test environment and run the checks listed above with your own tools.
- 4
Agree on terms
Put support access, managed services scope, and any business associate terms in writing before production data is connected.
Reaching us about security and privacy.
Security reports and security questions go through data.co/contact with "Security" in the subject. Our security.txt file at /.well-known/security.txt lists the same contact and the policy that applies. Privacy requests about personal data in our own services follow the process in the privacy policy.
Data.co is operated by Nead, LLC, an Arkansas limited liability company. Agreements, including any data processing addendum, are entered into by Nead, LLC doing business as Data.co.
Questions buyers ask
Does Data.co train models on our data?
No. Data.co does not receive your content, and does not use customer data to train models.
Can Data.co staff access our deployment?
Only if you grant access, for example during a support session or under a managed services agreement that defines it.
Do you have a SOC 2 report?
Not yet. Status will be posted on this page and the compliance page when available.
How do we complete a security questionnaire for Data.co?
Contact us and we will respond. Many questions about data storage and processing are answered by the deployment model: the content stays in your environment.
What does app.data.co know about our deployment?
The organization, its members and roles, the license issued for the deployment, billing state, and Control configuration you manage there. If you opt in to telemetry, it also receives health and version data. It never receives content.
Will you notify us of a security incident affecting our account?
Notification commitments are set out in your agreement and the data processing addendum. Because content stays in your deployment, an incident at app.data.co would concern account, licensing, and billing data.
See it against your own use case.
A 30-minute technical walkthrough, policy simulation on your scenarios, and a deployment recommendation for on-prem, private cloud, or hybrid.