---
title: "Protect data across every boundary"
description: "Duale AI's data protection model defines encryption at rest, SDK-to-platform transport protection, and the external systems a task can reach."
lang: en
status: public-preview
lastUpdated: 2026-09-03
url: https://dev.duale.ai/en/docs/security/data-protection
---

## AI-generated summary

Data protection covers how Duale AI encrypts customer data at rest, protects data in transit between SDK and platform, and bounds external data paths a task can reach.

- AES-256-GCM encrypts Library source files, extracted content, and search data at rest.
- TLS plus RFC 9180 hybrid encryption protects task request bodies and event streams.
- Tasks can reach model providers, public Web, package registries, and customer tools.
- Telemetry is the one path the platform does not protect; set an https endpoint.
- Retention periods are owned by the Privacy notice, not this page.

Summaries were generated by AI. Generative AI is experimental.

---

This page states which customer data has application-level encryption, how data moves between the SDK and the platform,
and which external systems a task can reach. The [Privacy notice](https://dev.duale.ai/en/legal/privacy.md) owns the retention periods.

## What the platform encrypts at rest

The managed service applies application-level encryption before storage to these customer-data categories:

| Data category                                            | Protection                                        |
| -------------------------------------------------------- | ------------------------------------------------- |
| Library source files, extracted content, and search data | AES-256-GCM object encryption                     |
| Database backups and copies used for reporting           | AES-256 encryption                                |
| Optional user context inside an audit event              | Encryption with a tenant-specific application key |

Each Library object has its own data key, which the service wraps with a service-managed key ring. Duale AI operates
the keys. Access to the stored bytes alone is not enough to read the protected data. A customer-hosted deployment lets
an eligible customer operate the infrastructure boundary under its deployment agreement.

Audit events keep their searchable event metadata, system context, before and after state, and compliance fields
separate from the encrypted optional user context. When a tenant is erased, the service disables the tenant audit key
for application use. The key record remains stored for lifecycle control.

Page access uses a separate cache rule: it caches only eligible GET resources from public pages. Requests with cookies
or authorization credentials bypass the cache. Entries are tenant-scoped, kept for about seven days, and stored without
application-level encryption at rest.

[Security and data handling](https://dev.duale.ai/en/docs/libraries/security.md) owns Library encryption, restore, and deletion behavior.
[Evidence and audit](https://dev.duale.ai/en/docs/security/evidence-and-audit.md) owns the meaning and limits of audit records.

## How task and Library data moves

TLS protects every service path. The Python SDK adds RFC 9180 hybrid public key encryption to task request bodies, task
event streams, and the agent lifecycle calls that publish your tools.

Every path below starts at your host. The SDK opens each one outbound, and Duale AI opens none back to it, so this table is also the list your egress policy has to allow.

| Path                                  | Protection                                                                    |
| ------------------------------------- | ----------------------------------------------------------------------------- |
| Python SDK task submission and events | TLS plus RFC 9180 encryption bound to the API token                           |
| Agent registration and heartbeats     | TLS plus the same RFC 9180 encryption, bound to the API token                 |
| Library management calls              | HTTPS authenticated with the API token                                        |
| Document bytes                        | HTTPS to a short-lived signed upload URL without the bearer token             |
| Telemetry export, when you enable it  | Whatever the endpoint you configure provides, with a separate telemetry token |

Library calls reach the same origin as your task endpoint; document bytes reach the storage host named in the upload response; telemetry reaches only the collector you set. The task envelope does not apply to Library calls or document transfers.

Telemetry is the one path the platform does not protect for you. `DUALE_OBSERVABILITY__ENDPOINT` accepts any scheme, defaults to a local address, and carries your telemetry token as a bearer header. Set an `https://` collector whenever telemetry leaves the host.

A signed part-upload URL is valid for six hours, so keep it out of logs and share it only with the upload process that
needs it.

The SDK contains no platform private key. It retrieves the platform public key at run time, so a platform-key change
does not require an SDK release.

## External data paths

A task can send data to systems outside the managed Duale AI platform:

| Path                    | What can cross it                                                                 |
| ----------------------- | --------------------------------------------------------------------------------- |
| Selected model provider | Conversation input and the model response                                         |
| Public Web research     | A research query or page URL, then search results and public-page content         |
| Public package registry | A package request and package bytes when a required snapshot is not already ready |
| Customer tool           | The registered tool name, arguments, and result                                   |

Customers choose and contract with their model providers. The agent can choose public Web destinations, packages, and
registered tool calls within the task's configured bounds. [Shared responsibility](https://dev.duale.ai/en/docs/security/shared-responsibility.md)
assigns the controls on each side of these paths.

Web research queries can appear in service logs and trace attributes. Those records follow the retention periods in the
[Privacy notice](https://dev.duale.ai/en/legal/privacy.md). Do not put a secret in a research brief or URL.

## Telemetry and customer-managed caches

Platform telemetry can retain model inputs and outputs, tool arguments and results, and system or developer
instructions. Treat telemetry as a content-bearing processing location and apply the retention period in the Privacy
notice. Telemetry is separate from the audit log.

The `@activity` SDK cache is customer-managed. It writes to a local SQLite file or a Redis server that you operate and
does not add encryption. Apply your storage and network controls to that cache. If the application has no `@activity`
function, the cache does not start.

Platform result caches stay within one tenant. A request from another tenant cannot address an entry. The platform does
not cache streaming requests, tool-calling requests, or conversation continuations.

Return to [Security](https://dev.duale.ai/en/docs/security.md) for the full task lifecycle.

## Related content

- [Security controls for production agents](https://dev.duale.ai/en/product/security.md)
- [Know what the platform defends](https://dev.duale.ai/en/docs/security/threat-model.md)
- [How the platform protects and removes your documents](https://dev.duale.ai/en/docs/libraries/security.md)
- [Secure your use of the platform](https://dev.duale.ai/en/docs/security.md)
- [Python SDK for bounded agent work with typed results](https://dev.duale.ai/en/docs/sdk.md)
- [Integrate model routing in an application](https://dev.duale.ai/en/docs/model-routing/application-integration.md)

---

## Sitemap

See the full [Markdown sitemap](https://dev.duale.ai/sitemap.md) for all pages.