Security

In Transit: All data transmitted between your device and our servers uses industry-standard TLS encryption, the same security standard used by banks and financial institutions.

At Rest: Journal entries are stored in an encrypted database using industry-standard encryption.

Backups: Database backups are also encrypted and stored securely with limited access controls.

Magic Link Login: We use passwordless authentication via email magic links. No passwords means no password databases to breach and no forgotten password vulnerabilities.

Session Management: Sessions expire after a period of inactivity and use secure token-based authentication to prevent unauthorized access.

Account Isolation: Your data is strictly isolated from other users. Our database queries enforce user-level access controls at every layer.

Cloud Provider: We host on Vercel and use Prisma Cloud for database management, both of which maintain SOC 2 compliance and industry-leading security standards.

Network Security: All services run behind firewalls with strict access controls. Only necessary ports are exposed, and all services use the principle of least privilege.

DDoS Protection: Our infrastructure includes DDoS mitigation and rate limiting to prevent service disruption.

OpenAI Integration: We use OpenAI's API to generate insights and personalized content. All API requests are encrypted in transit and processed securely.

Limited Data Sharing: We only share the minimum necessary data with third parties (OpenAI for AI features). We never sell or share your journal entries with marketers, advertisers, or data brokers.

Email Service: We use Resend for transactional emails (magic links, summaries). They process emails securely but do not have access to your journal content.

We keep it. When you record a voice note, or talk to Dayora on a call, we keep the audio itself, not only the transcript.

Why: so our team can check the quality of what Dayora heard and what it said back. Transcription mishears people, and a reflection is only as good as the words underneath it.

How long: indefinitely. Nothing expires it on a timer.

Who can reach it: for a voice note, you, played back on the entry it came from. For call audio, our team only: there is no playback screen for calls in the app yet, so you cannot listen back to one. Our team, for that quality check. OpenAI, which does the transcribing and runs the live call. Nobody else, and it is never sold or shared. Voice note playback runs through a signed-in route that checks the recording is yours before it returns a byte. For call audio, the storage address is never handed to a browser. The stored file itself is not individually access-controlled, so the protection is that its address is never given out rather than a lock on the file.

Encryption: recordings travel to us over HTTPS. We do not claim any application-level encryption of the audio files themselves, because there isn't any.

How it goes away: deleting your account deletes the audio with it. For a call, choosing "let it go" when the call ends, or deleting the call's thread from Reflect, deletes its recording too. Deleting a single journal entry removes the entry, not the voice-note recording behind it. To have any other recordings removed without closing your account, email human@dayora.ai and we will delete them.

Dependency Management: We regularly update all dependencies and monitor for known vulnerabilities using automated security scanners.

Input Validation: All user input is validated and sanitized to prevent SQL injection, XSS, and other common attacks.

Error Handling: Error messages never expose sensitive information or system details that could aid attackers.