Security & trust
Where DouJou runs has its own page. This one is about what it enforces once it's running — who can see what, what gets written down, and what happens when we find our own mistakes.
Who can see what
DouJou runs on the identity and permissions your company already has — it doesn’t introduce a second, parallel set of rules to keep in sync.
DouJou reads permissions from the identity system your company already runs — no separate login to provision or forget to revoke.
An answer is only built from documents the asking user already has access to — DouJou never widens someone’s reach.
New data sources are connected read-only unless a task specifically requires more — access is granted deliberately, not by default.
Remove someone’s access in your identity system, and their access to DouJou disappears with it — nothing left over to clean up.
Every action, logged
100%
of requests and responses logged
What was asked, what left the building, and what came back.
0
unlogged paths to an outside model
There isn’t a side door — every call to an outside AI model runs through the same checked path.
1
place to look when something needs explaining
A single, exportable trail — not logs scattered across whichever tools people happened to use.
A worked example, not a policy statement
The claim “your data is redacted and logged before it reaches any AI model” is only worth what the engineering behind it is worth. So here is how we actually treat it, using a real example rather than an assurance.
While reviewing an unrelated change, we audited every path in the product that sends data to an AI model. We found several that weren’t applying the governance we describe — including one inside the code path we considered our own reference implementation. No customer reported them. We found them by looking.
Closed every one of them in the same release and shipped it to all production deployments. Then made the guarantee structural instead of careful: an automated check now fails the build if any new code sends data to a model without going through the governance layer. It has to be explicitly and visibly exempted, with a stated reason, or the build stops.
Because it immediately found several more paths that our own manual review had already walked past. The durable fix was never “be more careful” — it was making the failure impossible to introduce silently.
This is what a vendor finding its own defects looks like — the alternative isn’t a product with no defects, it’s a product where nobody went looking. If you’re evaluating us, that distinction is a fair thing to probe. We’d rather you did.
For your security reviewer
Whoever signs off on this will ask the same questions every time. Here are the answers up front, so your champion doesn’t have to come back to us for them.
Anything on this list we can walk through against a live deployment rather than a datasheet.
Compliance alignment
DouJou doesn’t replace your compliance programme — it gives it something concrete to point at instead of a verbal assurance from an AI vendor.
Next step
The security review is the part of this we most want to have — not the part we’re trying to get past.