Trust Center

Overview

DramaLabs makes Nisa AI, an AI co-worker for companies anywhere in the world. We build to the EU’s data-protection rules (GDPR) as the floor for every customer, wherever they are. This page is the short version of how we handle your data. The full detail is in our Privacy Policy. Our Data Processing Agreement (DPA) is available on request. Ask and we will send ours, or we will review yours.

We are preparing SOC 2 and ISO 27001 with Vanta. We do not hold either certification today.

• Your data at rest is stored in the EU: Germany, the Netherlands and Finland.
• The AI reasoning step runs at model providers in the US, at the moment of each request.
• We never train or fine-tune a model on your data.
• Money, messages to other people, deleting and publishing go through an approval card by default; you decide what may run without one.
• You can export your data, and we delete your account and its data on request.

Data locations

• API, database, company brainHetzner, Germany (EU)
• Backups of database and brainBackblaze B2, Amsterdam, Netherlands (EU)
• Web dashboard (app.dramalabs.co)Vercel, Frankfurt region (EU); stores no data
• Our AI request logsHetzner, Finland (EU)
• AI model inferenceModel providers in the US, per request
• Sandboxes for tasks, code and web pagesE2B, US; discarded after each task

EU hosting by default; US hosting available on request.

The messaging surfaces you use (Slack, WhatsApp, Microsoft Teams, email) carry messages on their own infrastructure; each is listed with its location under Subprocessors.

Hosting & data residency

Our core application’s account, company brain, conversation and run-output records are stored and processed in the EU: the API and the database run on Hetzner infrastructure in Germany, and the web dashboard (app.dramalabs.co) is served by Vercel from its Frankfurt region. Vercel’s network terminates your connection at the node nearest to you and forwards it to Frankfurt; for a visitor outside the EU that node is outside the EU. Nothing is stored there, and our API’s data at rest stays in Germany. This describes our application hosting, not copies held by messaging providers below. The controller is DramaLabs, Inc., a Delaware corporation.

Every copy we keep at rest is in the EU: the database and your company brain on Hetzner in Germany, backups of both with Backblaze in Amsterdam, and our own AI trace logs on Hetzner in Finland. The exception is the AI reasoning step itself, which runs at US model providers at the moment of each request (next section).

AI processing & international transfers

AI processing happens with leading AI model providers in the US, at the moment of each request. We send only what a task needs. We never train or fine-tune a model on your data. We have signed data-processing agreements with these providers.

Your content is not used to train AI models

We never train or fine-tune any model on your data. Under the API terms of our default AI model providers, content sent through their APIs is not used to train their models, and we have not opted in to any such use. This describes our default model providers only; it is a provider’s own term, not a promise we can make for every provider a request could ever reach. Providers may keep request data for a limited period for abuse monitoring under their own terms; we do not yet hold zero-data-retention agreements, and we will say so here when we do.

Your company brain is yours

What Nisa knows about your company lives in your workspace, as readable files and records on our servers in Germany, not inside an AI model. A model receives only the excerpts a task needs, at the moment of the request, and keeps nothing from one request to the next beyond the provider retention described above.

• You can read and correct what Nisa knows, and delete individual facts.
• A workspace admin can export the knowledge and workers as a download at any time.
• It is never shared with another workspace, and it is deleted with your account.
• Sources you mark as sensitive are only used in your direct messages, never in shared channels.

Documents

• Privacy PolicyHow we handle personal data, your rights, retention.
• TermsThe terms of the service.
• Data Processing AgreementSigned DPA on request; we send ours or review yours.
• Security documentsPolicies, architecture overview and security questionnaire, on request.
• Subprocessor listWho processes your data, for what, and where.
• Data deletionHow to have your account and its data deleted.
• Credits and pricesWhat each action costs in credits.
• SOC 2 reportNot available yet. We are preparing SOC 2 and ISO 27001 with Vanta and will list a report here when one exists.

Your rights & your data

You can export your data at any time, and we delete your account and its data on request; deletion cascades across your tenant. To exercise any GDPR right (access, rectification, erasure, portability, objection), email privacy@dramalabs.co. See Data deletion for the deletion path.

Acceptable use

Nisa sends, posts and books in your name, so a few rules come with her. You agree not to use her to:

• deceive people: pretend to be a person or an organisation you are not, or hide who a message is from;
• send bulk unsolicited messages, or anything built to get around a recipient’s opt-out or a platform’s limits;
• break the law, or the terms of the platforms and tools you connect.

Rules about contacting people differ from place to place, and the local rules where your recipient is apply to every message. You are the sender of what Nisa sends in your name, and you are responsible for following those rules. We provide the tool; we are not the sender, and nothing on this page is legal advice.

Credits

Usage is counted in credits, and you are charged per action, such as a chat turn, a Skill run or a web search, not per word. Each kind of action has its own price in credits, listed in the credits documentation. Changing the model behind an action does not change its price.

• Your plan adds credits each billing period. Plan credits expire two months after the day they arrive, so unused ones carry into the next period. If you cancel your plan, its remaining plan credits end with it.
• Credits you buy on top of your plan (a power-up) expire 12 months after purchase. Cancelling your plan does not remove them. Power-ups bought before 15 October 2026 keep the no-expiry terms they were sold with.
• The credits you receive when you sign up are time-limited; the app shows when they expire.
• We always spend the credits that expire soonest first.
• When your balance reaches zero, actions that cost credits pause until credits are added, and Nisa tells you rather than skipping work silently.
• Credits are not money: they cannot be paid out, exchanged for cash or moved to another workspace.

Approval where it matters: a person decides

By default, money, anything sent in your name to other people, deleting or overwriting, and anything made public go through an approval card and wait for a person’s click. Small additions you ask for in your own tools, such as a new row in your own sheet or a calendar hold without guests, run without a card, with a one-line note of what was done. This is enforced in code, not just policy.

A person can allow actions in advance: in words, for one action to the recipients on that card, or on a permission screen, for one kind of action from one connected account, to any recipient, for a period they choose. A workspace owner or admin can also switch the whole workspace to a mode where sends, deletes and publishing run without a card; it is switched on only by a click (its confirmation card, Settings, or “Handle it all” during setup). Payments still ask every time, under every permission and in that mode.

Where this does not reach yet: some other changes in your connected tools that the tool itself can reverse, such as adding a record, also run without a card when you ask for them. Nisa reports each one, but she cannot yet undo all of them for you.

Security

Encryption & access

The API keys and tokens you connect are encrypted at rest. Traffic is served over TLS. Each tenant’s data is isolated; a workspace can only ever see its own workers, brain and connections. Scheduled tasks, code Nisa runs and web pages she opens for you run in isolated, short-lived sandboxes that are discarded afterwards.

Reporting a vulnerability

Found a security issue? Email security@dramalabs.co with what you found and how to reproduce it. We answer within 5 business days, keep you informed while we fix it, and ask that you give us reasonable time to fix it before you make it public. We will not pursue anyone who reports in good faith, does not access more data than needed to show the issue, and does not disrupt the service or other customers.

If something goes wrong

If a security incident affects your data, we notify affected customers without undue delay, tell you what happened and what data was involved, and what we are doing about it.

AI transparency

Nisa is clearly an AI assistant, never presented as a human, and her drafted output is shown as AI-generated for you to review before it is sent, unless a permission or the workspace mode described above lets it go without a card. This is consistent with the EU AI Act’s Article 50 transparency expectations.

Subprocessors

These providers process customer data for us. We announce subprocessor changes by email and in the update log on this page. Subscribe to changes.

As of 25 October 2026

Transfers outside the EU rely on the data-processing agreements we have signed with these providers, except the optional iMessage channel.

Frequently asked questions

Update log

• 20 October 2026Trust Center: compliance status, data locations, security reporting, acceptable use, credits and FAQ added. The approval section describes advance permissions and the workspace mode that runs without cards. Subprocessors listed by name, purpose and region, here and in the Privacy Policy.
• 17 October 2026Approvals: actions are now gated by what is at stake, and a person can allow actions in advance.
• 5 October 2026Subprocessors: Serper (web search) and Unipile (LinkedIn) named; our AI trace logs on Hetzner in Finland named.
• 2 September 2026Subprocessors: Vercel added, serving the web dashboard from its Frankfurt region.
• 19 August 2026Subprocessors: Microsoft added, for Nisa in Microsoft Teams.