dembrane

If you discover something that may impact your security or the security of the platform dembrane, please fill in this form: https://dembrane.notion.site/cc3d257b14ea462ca8272c6837278eb0?pvs=105

We would appreciate if you could refrain from making public disclosures until you've heard from us!

dembrane has not yet completed a penetration test. We plan to run an internal penetration test first, followed by an independent external test. As of yet the external pen test is planned in Q1 2027.

dembrane does currently not have a bug bounty program. However, we believe that anyone who responsibly reports a security issue deserves credit for it. We will gladly acknowledge your contribution, for example in our release notes or by name on request.

dembrane processes and stores all customer data within the EU. Primary storage and compute reside in north-west EU at DigitalOcean AMS3 in Amsterdam, and AI processing runs exclusively on Google Vertex AI EU endpoints.

All connections to the dembrane platform use TLS 1.3, with TLS 1.2 as the minimum accepted version. HTTPS is enforced on all endpoints, including the web application, the API and the participant-facing recording interface.

Connections between dembrane and our sub-processors use TLS 1.2 or higher over the public internet.

Data is encrypted with AES-256 across all storages:

Managed PostgreSQL databases (DigitalOcean, Amsterdam region), including session metadata, transcripts and generated analysis
Object storage for audio recordings (DigitalOcean Spaces, Amsterdam region).

We keep the audio sessions for the duration of the project. After the project ended, it will be deleted within 30 days. On request, it is always possible to delete the audio straight away or set another retention date.

The data will remain available on the platform to authorized workspace members for the duration of the agreement, unless a workspace owner or administrator deletes a conversation or project via the Workspace settings (in which case all associated audio, transcripts, metadata, and analytics will be deleted).

Client accounts are retained for the duration of the agreement. When an account is deleted via the settings, it is immediately suspended and permanently deleted within 30 days.

Yes, machine-readable export is available directly from the platform.

dembrane run under Chatham House rules. Transcripts contain no speaker attribution, so statements are not linked to named participants.

That reduces identifiability but does not make the data anonymous in the sense of the GDPR. Audio recordings contain participants' voices, and what people say can identify them, particularly in small groups or local settings. The data remains personal data and stays subject to your obligations as controller.

The dembrane platform features a de-identification setting, shown in the product as "Anonymize Transcripts" (currently in beta). When enabled, new transcripts have names, email addresses, phone numbers and physical addresses replaced with placeholders. Conversations processed this way have audio playback, audio download and retranscription disabled. The change cannot be reversed for conversations already processed.

dembrane currently uses a carefully selected mix of LLM's that are hosted on European servers but originally developed by leading American AI companies: simply because these models currently offer the best balance of quality and cost-effectiveness for understanding and organising conversations. We only work with trusted technology partners who contractually guarantee they will never use your data to train or improve their AI systems, ensuring your conversations remain private and secure.

However, we've designed dembrane to be completely flexible when it comes to LLM's. It's like having a universal adapter that works with different types of technology. If you prefer to use LLM's developed entirely in Europe, or even want to host the LLM completely on your own servers for maximum control, that is possible within the Guardian tier subscription.

Our platform has 2 LLM features and are classified as follows: Transcription (minimal risk) and Chat & Analysis (limited risk (subject to Art. 50 transparency obligations). Our Chat and Reports features tell users that they are interacting with an AI system.

Yes! dembrane is designed for these settings and is also not a high-risk AI system under the EU AI Act. Some uses can still bring a deployment closer to the Annex III high-risk categories, for example when a public authority uses LLM output in a formal decision. In this case the deployer may need to take on extra obligations.

dembrane provides extra support to deployers such as facilitator training, LLM output that can be traced back to the source conversations, content verification during ongoing conversations and documentation for their own assessment. If you plan a deployment close to these lines, contact us before you start.

No. We do not use client data to train public or proprietary large language models (LLMs) unless explicit opt-in is given. Any LLM features we deploy are governed by strict data processing agreements that prohibit data retention beyond transient execution and prohibit model training.

However at dembrane, we are working to build European digital sovereignty. This involves benchmarking and training independent European LLM's to reduce dependencies on American AI providers. Organisations that wish to do so can explicitly choose to share data as innovation partners for this sovereignty goal. Without an explicit opt-in from the client, all customer data remains 100% shielded from any model training.

An organisation contains separate workspaces, and each workspace is its own boundary for projects, conversations and transcripts. Access does not flow down: organisation membership grants no access to workspaces, and a user can be invited into a single workspace without seeing anything else in the organisation.

Within a workspace, permissions are role-based across six roles, ranging from owner with full administrative control to a read-only role with no editing or query rights. Separate roles exist for billing-only access and for external collaborators. Users cannot grant a role higher than their own.

Access to systems is limited by role-based access control (RBAC), following the principle of least privilege. All access requires documented approval and is enforced through SSO and MFA on all infrastructure. We review access rights every quarter. dembrane staff only accesses client data at the client's request or after a maintenance notification.

BIO2 applies to Dutch government organisations, not to their suppliers. Public sector clients pass the relevant requirements to us through procurement and contract, and that is how we handle them. BIO2 builds on ISO 27001, and our ISO 27001:2022 certification covers that underlying control set. We are working through the government-specific measures BIO2 adds on top of it.

dembrane is not designated as an essential or important entity under the Cyberbeveiligingswet (Cbw), the Dutch implementation of NIS2. We fall below the size thresholds that bring an organisation into scope.

Several of our clients are in scope and must manage supplier security risk as part of their duty of care. We support that through our ISO 27001:2022 certification, our contractual security and incident notification commitments, and our published sub-processor and infrastructure documentation. We are reviewing Cbw requirements to confirm our controls meet what clients in scope need from a supplier.