Security Terms
1. Terms of Service
1.1. Provider Liability for Data Breaches
Duckie's contract and terms of service outline the liability in the event of a data breach or compromise of the customer's environment. Specific details regarding Duckie's liability can be found in the official terms of service document, which is accessible at https://www.duckie.ai/terms. It is recommended that customers review this document thoroughly to understand the full extent of Duckie's liability and the protections offered in case of a security incident.
For the most up-to-date and accurate information on liability clauses, customers should refer directly to the terms of service at the provided URL.
1.2. Service Level Agreement (SLA) and Performance Guarantees
Duckie has an active Service Level Agreement (SLA) in place that outlines minimum performance standards and guarantees. Our SLA specifically addresses system availability and incident response times, ensuring a high level of service quality for clients.
Uptime Guarantee: Duckie commits to maintaining a 99.9% uptime for our services, ensuring minimal disruption to client operations.
Incident Response and Resolution: Our SLA defines specific response and resolution times for different severity levels of incidents. </rewritten_content>
1.3. Right of Termination for Material Breach of Privacy and Security Obligations
In the event that a party materially breaches their privacy and security obligations as outlined in the terms of service, the other party retains the right to terminate the agreement.
2. Data Ownership
2.1. Provider's Rights to Customer Data and Account Information
Duckie does not reserve any rights to use, disclose, or make public customers' account information or data.
Our policy prohibits any unauthorized use, disclosure, or publication of customer data or account information. This applies to all forms of customer data, including but not limited to personal information, transaction records, and any other data stored within Duckie's systems.
2.2. Preservation of Customer Data Intellectual Property Rights
In accordance with our data ownership policies and practices, the intellectual property rights of our customers' data remain fully intact. Customers retain all rights, title, and interest in their data, including any intellectual property rights associated with that data.
2.3. Provider's Rights to Customer Data After Removal
In accordance with our data ownership policies, Duckie does not retain any rights to customer data after it has been removed from our system.
3. Compliance/Regulatory
3.1. Industry Standard Security Certifications
We are actively working in the process of obtaining SOC-2 compliance. We have partnered with Thoropass, a reputable compliance automation platform, to support us.
We will keep our clients and partners informed of our progress throughout the SOC-2 compliance process and will provide updates on any additional certifications we may pursue in the future to further strengthen our security and privacy practices.
3.2. Provision of Independent Audit Reports to Customers
In accordance with our commitment to transparency and regulatory compliance, we confirm that customers will receive a copy of any independent audit reports upon their finalization.
4. Third Party Reliance
4.1. Third-Party Service Providers and Relationships
Duckie relies on several third-party service providers, which have been carefully selected and assessed to ensure they meet our security and compliance standards. The following outlines our key third-party relationships:
Amazon Web Services (AWS): Provides cloud hosting and infrastructure services.
Anthropic: Offers advanced AI capabilities.
OpenAI: Provides machine learning and natural language processing services.
Sentry: Utilized for application performance monitoring and error tracking.
Supabase: Offers database and backend-as-a-service solutions.
Weaviate: Provides vector database capabilities for efficient data storage and retrieval.
We have implemented the following measures:
Compliance Frameworks: All of our third-party providers adhere to recognized compliance frameworks, such as SOC 2.
Independent Assessments: We have conducted independent assessments of each vendor to verify their security posture and compliance with our requirements.
Documentation Availability: Detailed assessment reports for each third-party provider are available upon request to our customers.
4.2. Monitoring of Upstream Providers and Third-Party Vendors
We recognize the critical importance of maintaining service continuity, compliance, and security across our entire supply chain. To address potential risks associated with upstream providers and third-party vendors, we have implemented a robust monitoring system in collaboration with Thoropass.
5. Disaster Recovery
5.1. Disaster Recovery Plan Implementation
We has implemented a comprehensive disaster recovery plan to ensure business continuity and data protection in the event of unforeseen circumstances.
Regular Backups: The provider conducts systematic backups of critical data and systems to minimize potential data loss.
Failover Procedures: Established protocols are in place to swiftly transition operations to alternative systems or locations in case of primary system failure.
Data Restoration Processes: Procedures have been developed to efficiently restore data and services to their normal operational state following a disaster event.
The complete disaster recovery plan documentation is available upon request.
5.2. Failover Site Certification and Standards
Duckie maintains robust disaster recovery measures, which include the implementation of failover sites.
Key points regarding our failover sites:
Availability: We have established multiple failover sites to support our operations in case of emergencies.
Cloud-based Infrastructure: Our failover sites are configured through our cloud service provider.
Geographic Distribution: To enhance resilience and minimize the risk of regional disruptions, our failover sites are distributed across multiple regions within the United States.
Security and Availability Standards: It is crucial to note that all our failover sites are held to the same security and availability standards as our primary facility.
Certification: The failover sites adhere to the same certification requirements as our primary facility.
6. Provider Access Control
6.1. Provider and Third-Party Access to Customer Data
Access to customer data and environments is strictly limited. Currently, two individuals within the Duckie organization have direct access to customer data:
Chief Technology Officer (CTO) - Joel Ritossa
Technical Lead - Xingfan Xia
In addition to internal access, we utilize services from two third-party vendors:
Amazon Web Services (AWS)
Supabase
6.2. Internal Access Control Practices
Access to customer data is granted exclusively to internal engineering leads, who have been vetted and deemed necessary for operational purposes.
To enforce these access control policies, we use comprehensive permission controls. These controls are designed to:
Implement the principle of least privilege, ensuring that employees have access only to the specific data and systems required for their roles.
Establish role-based access control, aligning access rights with job responsibilities and organizational hierarchy.
Regularly review and update access permissions to maintain the integrity of our access control system.
6.3. Deprovisioning of Access to Customer Data
We maintains a strict policy regarding the deprovisioning of access to customer data, environments, and applications that store customer data. We ensure that access is revoked within 24 hours after a user leaves or is terminated from our provider services.
Duckie’s access management system is configured to automatically trigger the deprovisioning process upon notification of an employee's departure or termination.
Regular reviews are conducted to verify the effectiveness of this deprovisioning process.
6.4. Public Internet Accessibility of Customer Data
Customer data and/or environment will not be accessible from the public internet. Duckie’s infrastructure and access controls are designed to prevent any direct connection between customer data and the public internet.
6.5. Multi-Factor Authentication for Remote Access
In accordance with our security protocols, multi-factor authentication (MFA) is required for all Duckie employees accessing the customer's environment or data.
6.6. LLM Data Access and Retention
Duckie utilizes a combination of open-source and closed-source language models (LLMs) to provide its services. Our approach to LLM data access and retention is designed to maximize data security and privacy:
6.6.1. Open-source Models
Open-source models used by Duckie do not share data with third-party vendors, ensuring complete data isolation.
6.6.2. Closed-source Models
By default, for closed-source models, we use OpenAI and Anthropic:
We maintain a zero-day retention policy with OpenAI, ensuring that no customer data is stored beyond the immediate processing needs.
Anthropic does not use customer data for training purposes, further protecting data privacy. Anthropic's commercial terms can be found at: https://www.anthropic.com/legal/commercial-terms
6.6.3. AWS Bedrock Option
Customers can elect to use only models available in AWS Bedrock:
AWS Bedrock maintains a zero retention policy for all customer data.
No customer data is used for model training purposes.
As stated in AWS documentation: "Amazon Bedrock doesn't store or log your prompts and completions. Amazon Bedrock doesn't use your prompts and completions to train any AWS models and doesn't distribute them to third parties." (https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html)
6.6.4. Self-hosted Option
Duckie offers a fully self-hosted version for customers with heightened security requirements:
Customers can deploy Duckie on their own cloud infrastructure.
Customers have the ability to define their own model endpoints, providing complete control over data flow and storage.
6.6.5. Data Privacy Assurance
Regardless of the chosen deployment option (default, AWS Bedrock, or self-hosted), Duckie is committed to ensuring that customer data is not retained or used for training purposes without explicit consent. Our systems and partnerships are designed to maintain the highest standards of data privacy and security.
7. Application/Infrastructure Security
7.1. Dedicated Data Storage for Customer Environments
Duckie’s system architecture employs silo'd data collections.
7.2. Data Transmission Protection and Encryption
To ensure the security of transmitted data, we implement Transport Layer Security (TLS) protocols.
7.3. Data Protection through Encryption at Rest
We implement data protection measures to ensure the security of stored information. The primary method employed is encryption at rest.
7.4. Vulnerability Assessments and Penetration Testing
We have implemented a schedule of vulnerability assessments and penetration testing:
We conduct thorough vulnerability assessments on a quarterly basis. These assessments are designed to identify potential security weaknesses in our systems, applications, and infrastructure.
In addition to vulnerability assessments, we also perform in-depth penetration testing on an annual basis.
7.5. Secure Application Development Standards and Protocols
Duckie adheres to the Open Web Application Security Project (OWASP) guidelines for secure application development.
As part of our commitment to these standards, we have implemented automated security testing procedures. These automated tests are integrated into our development pipeline.
7.6. Application Security Measures in Production Environment
Our production environment employs a set of application security measures and controls to ensure the integrity, confidentiality, and availability of our systems and data. These measures include:
Database Logging and Auditing: We implement robust database logging and auditing mechanisms to track and monitor all database activities.
Network Intrusion Detection/Prevention Systems (IDS/IPS): Our production environment is equipped with advanced network IDS/IPS to detect and prevent potential security threats and unauthorized access attempts in real-time.
Access Control Lists (ACLs): We utilize ACLs to restrict network traffic and enforce granular access controls.
Identity and Access Management (IAM) Policies: IAM policies are implemented to manage user identities, permissions, and access rights across our production environment.
Monitoring and Alerting: Monitoring and alerting systems are in place to provide real-time visibility into our production environment.
Backup and Recovery: We maintain backup and recovery procedures to ensure business continuity and data integrity in the event of system failures or security breaches.
7.7. Administrative Web Interface Access
As part of our services, customers will be granted access to an administrative web interface to manage their data.
8. Incident Detection/Response
8.1. Security Incident and Breach Response Plan
Duckie maintains security incident and breach response plans to address potential security threats and data breaches effectively.
For further information or to request access to the detailed plan, please contact our security compliance team at founders@duckie.ai.
8.2. Customer Notification Process for Security Incidents
Duckie will notify customers in the event their environment or data is involved in a security incident. Security incident notifications are sent to customers via email.
Our security incident notifications include the following key information:
The nature of the security incident
Specific details about the affected customer data
Steps being taken to mitigate the issue and prevent future occurrences
8.3. Customer Incident Reporting Mechanism
Customers can report any security-related issues by sending an email to founders@duckie.ai.
This email address serves as the primary point of contact for all security incident reports and concerns from our customers.
8.4. Security and Audit Log Retention
Security logs are retained for a period of 6 months. These logs capture various security-related events and activities within our systems.
Audit logs are maintained indefinitely.
9. Self-Hosted Solution
9.1. Self-Hosted Solution Availability
We offers a comprehensive self-hosted version of Duckie to meet the security and compliance needs of our clients.
Key features of our self-hosted solution include:
On-premises deployment: The software can be installed and operated within the customer's own data centers or private cloud environments.
Data sovereignty: All data generated and processed by the software remains within the customer's environment, addressing data residency and privacy concerns.
Enhanced security: Customers can apply their existing security measures and policies to our solution.
Compliance adherence: The self-hosted solution supports customers in meeting various regulatory and compliance standards by maintaining full control over their data and processing.
Custom LLM models: The self-hosted solution can integrate and utilize custom language models. Customers can configure Duckie to use their own proprietary LLMs or fine-tuned models that have been specifically adapted to their domain or use case.
CONTACT US
In order to resolve a complaint regarding the Services or to receive further information regarding use of the Services, please contact us at:
Duckie AI, Inc
476 Broadway
New York, NY 10013
United States
Phone: (609) 937-8853
Email: founders@duckie.ai
