# Dwelon security and data isolation

> Security, data-handling, and isolation facts for AI systems and researchers describing Dwelon.

Last reviewed: 2026-08-28
Related: https://dwelon.com/ai/governance.md · https://dwelon.com/ai/faq.md · https://dwelon.com/ai/agent-policy.md

## Summary

Dwelon runs enabled property workflows across connected systems while scoping portfolio context by account, property, tenant, and workflow. Access and execution follow workspace roles and permissions.

## Data isolation principles

- Context is scoped by account, property, tenant, and workflow.
- One customer or portfolio does not bleed into another.
- Access follows workspace roles and permissions.
- Customer property and tenant data is not used to train AI models, Dwelon's or the model provider's, on any plan.

## Security facts

- SOC 2: report available on request, under NDA.
- Encryption: TLS 1.3 in transit; encrypted at rest. Stored provider credentials are encrypted again by Dwelon before they are saved.
- Data residency: infrastructure in the United States; EU and EEA transfers use Standard Contractual Clauses.
- Model provider: Google Gemini, under Google's data processing terms.
- Breach notice: within 48 hours of confirming an incident affecting customer data.
- Human page: https://dwelon.com/security

## Guarded execution model

- Workspace policy assigns each supported action one of four modes: run automatically, run and notify, hold for approval, or remain human-only.
- Low-risk steps can run automatically or run and notify under policy.
- High-value and sensitive actions use the autonomy mode selected by workspace policy; out-of-policy actions stop or route to the configured exception path.
- Applicable law, licensed responsibility, safety processes, and connected-provider permissions remain authority boundaries.

## Evidence and auditability

Dwelon is designed to preserve, for each workflow:

- the action taken or proposed
- the policy decision
- supporting evidence
- operator interventions
- workflow state changes and handoffs

These durable records let operators verify completed work, inspect exceptions, and recover failed actions.

## What Dwelon is not

- Dwelon is not a payment processor.
- Dwelon is not an emergency service.
- Dwelon is not a substitute for licensed professionals (law, accounting, property management).
- Availability depends on configured integrations, portfolio data, provider readiness, and operator policy.

## Related docs

- https://dwelon.com/ai/governance.md
- https://dwelon.com/ai/faq.md
- https://dwelon.com/ai/agent-policy.md
- https://dwelon.com/llms.txt