AI Agents
Discovery Express

Trust

Security you can verify.

Every credential here has a document behind it. Ask and we send it.

ISO/IEC 27001:2022AWS Advanced TierREPSE, MéxicoYour tenant
Talk to an architectRequest documents
An information-security review over a printed network architecture diagram in a glass meeting room in Mexico City

Certifications

Four credentials, four documents.

Nothing on this list is in progress or aspirational.

ISO/IEC 27001:2022

Delivery, infrastructure and people, monitored in Vanta.

Certified Dec 2025

AWS Advanced Partner

The runtime and every client tenant run on AWS.

Advanced Tier since Jun 2026

Great Place to Work

The pod that deploys your agent stays on your account.

Verified Sep 2026

REPSE

Required to place engineers inside your operation in México.

Verified Sep 2026

Source: DaCodes compliance records, Sep 2026. Numbers shared under NDA in one business day.

Platform security

Your cloud, your keys, your logs.

The platform deploys inside your AWS account, with the access you grant.

01

Deployment in your tenant

Runtime, vector stores and logs in your account. One tenant per client.

02

IAM with least privilege

Scoped per agent and environment. You revoke our access in one console.

03

Private networking

Agents run inside your VPC, behind private endpoints.

04

Encryption and secrets

TLS on every hop, KMS keys you own, secrets rotated.

05

PII masking

Personal data is masked before it reaches a model.

06

Retention you define

Transcripts, traces and logs expire on your schedule.

Agent Console · Audit log
Demo data
tenant acme-mx · todayExport to SIEM
  1. 09:14:02Collections agenttool call · sap.read_invoiceallowed
  2. 09:14:03Collections agentmodel call · PII maskedmasked
  3. 09:14:05Collections agentapproval · payment plan over limitwaiting
  4. 09:16:40Finance leadapproval · payment planapproved
  5. 09:16:41Collections agentaction · whatsapp.sendlogged

Weekly quality report

Eval pass rate
98.4%
Escalations
12
Cost per run
$0.31
Incidents
0

One tenant's audit log and eight weeks of its quality report, from the Agent Console. Demo data.

AI governance

Your data trains nothing.

Six controls ship with every agent, in every tenant.

01

Evals and red teaming

Written before the first prompt, they gate every release.

02

Audit trail

Every decision and tool call logged, exportable to your SIEM.

03

Human in the loop

You choose which actions need approval. The agent waits.

04

Model usage policies

Which models, which tasks, which data classes. Enforced by the router.

05

No training on your data

Contractual with every model provider we use.

06

Weekly quality report

Eval pass rate, escalations, cost and incidents.

Data residency

United States or México. Always your account.

We deploy to the AWS region your policy asks for. Residency is a setting in your account, not a promise in ours.

US
United States
AWS U.S. regions
MX
México
AWS México region

Other clouds on request, same principle.

AWS regions, United States and México
UNITED STATESMÉXICOus-west-2Oregon1us-west-1N. California2us-east-2Ohio3us-east-1N. Virginia4mx-central-1Querétaro5
  1. us-west-2Oregon
  2. us-west-1N. California
  3. us-east-2Ohio
  4. us-east-1N. Virginia
  5. mx-central-1Querétaro

Region codes and locations as published by AWS.

Subprocessors

Who touches your data.

Model providers are subprocessors only when you select them.

  • Amazon Web Services
    Purpose
    Infrastructure, runtime, storage, Bedrock models
    When it applies
    Always, inside your account
    Data it sees
    All platform data, under your keys
  • Anthropic, OpenAI, Google
    Purpose
    Language models
    When it applies
    When your model policy selects them
    Data it sees
    Masked prompts and outputs, no training
  • ElevenLabs
    Purpose
    Voice synthesis
    When it applies
    Only if chosen over our voice stack
    Data it sees
    Text of the spoken turn
  • HubSpot
    Purpose
    CRM for the forms on this site
    When it applies
    When you send a form, and on every visit if you accept analytics
    Data it sees
    What you type into a form; with analytics consent, the pages you visit

List reviewed Sep 2026. Voice on the DaCodes stack runs in your tenant and adds no subprocessor.

Incident timeline
Demo data
Collections agent · tenant acme-mxPaused by kill switch

  1. 02:14

    Kill switch pauses the agent

  2. 02:15

    On-call engineer paged

  3. 02:21

    You hear it from us

  4. 09:00

    Root cause and fix shipped

02:21To your operations lead

  • Email
  • Phone call

The collections agent was paused at 02:14 by its kill switch. No message has reached your customers since. Next update at 03:00.

Continuity and incidents

You hear it from us first.

01

Backups and recovery

Cadence and recovery objectives per client, tested before go live.

02

Incident response

A named on-call engineer per account, a kill switch per agent.

03

Responsible disclosure

Found a vulnerability? Write to us. We answer every report.

Security contact

hola@dacodes.com

Subject line: Security.

FAQ

What security teams ask first.

Yes, and that is the default deployment. Runtime, context, logs and backups live in your account, encrypted with KMS keys you own. DaCodes operates through a scoped IAM role you can revoke.

No. Enterprise or API terms with every provider exclude training on your inputs and outputs, and PII is masked before a prompt leaves your VPC.

Yes. Every run is traced with inputs, tool calls, model, cost and outcome, and stored in your account. The Agent Console shows it; your SIEM can ingest it.

In your format, within one business week, with the ISO/IEC 27001 certificate and policies attached under NDA.

Talk to an architect

Bring your security questionnaire and your hardest question to the first Discovery Express session.

We reply in under one business day.

Loading the form