> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dmly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Data storage and security

> Where DMLY stores your data, how it's protected in transit and at rest, and how one workspace's data is kept separate from another's.

DMLY runs as a managed, hosted platform; there is nothing for you to install, patch or secure at
the server level. This page describes how the platform stores and protects the data you and your
contacts put into it.

<Note>
  This is a description of DMLY's practices, not legal advice or a formal contract. If your
  business needs a signed **Data Processing Agreement (DPA)** or specifics on data residency for
  your own audit, contact DMLY.
</Note>

## Where your data is stored

Customer data is hosted in secure, enterprise-grade cloud data centres in **Europe and the United
States**. The infrastructure is built for high availability, with redundancy and continuous
monitoring so the platform stays online and your data stays intact.

## Backups and recovery

DMLY takes regular backups and maintains redundancy and disaster-recovery procedures, so data can
be restored after a failure. Backups are an operational safeguard against loss; they are not a
per-workspace "undo". Actions you take inside DMLY, such as
[deleting a contact](/contacts/data-and-privacy#deleting-a-contact), are applied immediately and
are not something you can roll back yourself from a backup.

## Encryption

* **In transit**: every connection to DMLY, in the dashboard and over the
  [API](/api-reference/introduction), runs over HTTPS/TLS. Data moving between you and the platform
  is encrypted.
* **At rest**: stored data is protected using modern encryption standards on the servers that
  hold it.

## Access control

Access to customer data is limited to authorised personnel on a need-to-know basis, under
role-based permissions. Inside your own workspace, you control who on your team can see and do what.
See [Roles and permissions](/account/roles-and-permissions) to restrict who can export or delete
data, and [Security](/account/security) for account-level protections like two-factor
authentication.

## One workspace cannot see another

Every record in DMLY (contacts, conversations, bookings, invoices) belongs to a single
**workspace**, and every query is fenced to the workspace it runs in. One business's data is never
visible to another, even though many businesses run on the same platform.

The same isolation holds for the [agency and whitelabel](/agency/overview) layer: an agency reaches
only its own sub-accounts, and one sub-account's data is never exposed to another. This is enforced
on the server, not just hidden in the interface.

## Monitoring

The platform is continuously monitored, and security practices are reviewed and improved over time
as threats and standards evolve.

<Columns cols={2}>
  <Card title="Privacy and data protection" icon="user-shield" href="/compliance/privacy">
    Your rights over the data, GDPR, and who is responsible for what.
  </Card>

  <Card title="Secure your account" icon="shield-halved" href="/account/security">
    Two-factor authentication, single active session, and roles.
  </Card>

  <Card title="Data, privacy and consent" icon="user-lock" href="/contacts/data-and-privacy">
    How opt-out, export and deletion work in practice.
  </Card>

  <Card title="Roles and permissions" icon="user-shield" href="/account/roles-and-permissions">
    Limit who can export or delete data in your workspace.
  </Card>
</Columns>