How Dray protects your data

Where your data is stored

In the EU. Dray’s servers and database run in Amsterdam, and so do the database’s backups. Stored files are kept by Cloudflare, which we ask to keep them in Western Europe. Dray is run from the UK, and UK law treats the EU as protecting personal data to its own standard.

What the AI models keep

Nothing. Dray sends conversations to AI models to pick out the facts worth remembering and to prepare them for search. Every request goes through OpenRouter, and only to providers that have agreed not to store what we send and not to train on it, which OpenRouter calls zero data retention. Today those are Google, through Vertex AI, and Microsoft, through Azure. They can process requests outside the EU.

Who can read it

Your account’s data is walled off from everyone else’s inside the database. Row-level security keeps each account’s rows apart, and Dray’s services refuse to run with a database role that could get round it.

Nobody at Dray reads your conversations, memory or files unless you ask us to, for example in a support request. The only other reasons are security, stopping abuse or a legal requirement. Dray is not end-to-end encrypted, so our servers and the AI providers can read what they process.

Encryption

Everything between your browser, the extension, your coding agents and Dray travels over HTTPS. Cloudflare encrypts stored files with AES-256. Sign-in codes and chat link codes are stored only as fingerprints, never as the codes themselves.

Backups and deletion

The database is backed up continuously so that it can be restored after a failure, and the backups roll over every four weeks or so. When you delete a chat or a file, Dray deletes it at once. When you close your account, we delete everything in it within 30 days. Either way, it is gone from the backups within five weeks of being deleted.

Data protection law

Dray is run from the UK, so the UK GDPR applies, and the EU GDPR applies to people in the EU. The privacy policy sets out what we collect, the legal basis for each use and how to use your rights. Conversations often hold health and other sensitive details, which the law calls special categories. As the privacy policy says, Dray processes them only with your explicit consent, and we have assessed the risks in a data protection impact assessment.

Our providers

Railway runs our servers and database, Cloudflare our network and stored files, and OpenRouter routes requests to the AI models. Each holds a SOC 2 Type II report. The privacy policy lists every company that handles data for us, what it does and where.

Report a security problem

Email support@withdray.com with what you found and the steps to reproduce it. Please don’t access other people’s data or disrupt the service while you test.