How Duaer protects your company’s data

Where data is stored

• Duaer is a global online service run by Duaer, deployed in Alibaba Cloud’s Singapore region (ap-southeast-1). Wherever a company is, its organization’s database, files and company knowledge index are stored there.
• The original files in the systems you connect (Feishu, WeCom, Google Drive, Microsoft 365 and so on) stay where they are. Duaer keeps only the text and access it needs for the index.

Who sees what

• Company knowledge follows the source’s permissions: a document is found, and used in answers, only for people who can open it where it lives. See Permission-aware enterprise AI search and knowledge sources.
• Each person sees the workflows, credentials and knowledge their role allows. Workflows, credentials, knowledge and members belong to one organization and are not shared with another; an API key works only in the organization it was made in.
• Duaer checks documents shared with the whole company or with anyone for ID card numbers, bank card numbers, and passwords or keys. Owners and admins see what it finds and can keep those documents out of search.
• On the employee portal, conversations, what Ask Duaer remembers and data question results are seen only by the person; admins do not see them. See the Duaer employee portal.

Encryption

• All traffic uses HTTPS.
• Credentials are encrypted with AES-256 before they are stored, and so is the text of the company index; search terms are kept only as keyed hashes. A copy of the database alone shows neither the text nor the words in it.

How AI models use your data

• Duaer does not train models on customer data.
• To answer a question, Duaer sends a model only the passages that person may read and that bear on the question. It uses models Duaer chooses from its model pool, such as DeepSeek, Alibaba Cloud’s Qwen and Anthropic’s Claude, through each provider’s API.
• If models must run in your company’s own environment, ask Duaer for a private deployment. See the model pool and private deployment.

How long things are kept

• Audit log: 365 days.
• Knowledge search and answer statistics: 90 days.
• Slack, Microsoft Teams and Feishu group chat messages: the last 30 days only, in the knowledge base.
• Mail an employee connects: the last 90 days.
• Notes assistants write to the home page, and data question results: 30 days.
• Ask Duaer conversations on the employee portal: kept until the person deletes them; deleting a conversation deletes its messages.
• Disconnecting a knowledge source removes all of its content from the knowledge base.

Sign-in and audit

• Any account can turn on two-factor authentication; see two-factor authentication. An organization can have members sign in with single sign-on through its own identity provider (OpenID Connect); see Sign in to Duaer with your company account.
• In the audit log, owners and admins see who signed in and who changed members, credentials, workflows and keys, with the time and IP address, and can export it to CSV.
• AI use is recorded too: who searched and asked when, which tools ran, and how much model quota was used. By default an entry holds who, when, what and counts, never the text of questions or answers. Keep question text is off by default; only owners and admins can turn it on, and questions are then stored encrypted.
• Ask Duaer never remembers passwords, keys, ID, card or account numbers. Owners and admins can turn memory off for the whole organization.

Deleting data

Employees can delete their own conversations and memory at any time; owners and admins can remove members and disconnect knowledge sources. To delete your whole organization’s data, email contact@duaer.com and we delete it.

Reporting a security issue

Found a security issue? Email contact@duaer.com privately first, before anything is made public. Send security questionnaires to the same address.