Sign inStart free
← pricing

Security and compliance

A summary of how DailyByte protects accounts, payments, and customer data. This is an overview for procurement, not a certification. Contact sales for the full questionnaire and, once available, the SOC 2 report.

in place today

  • Sandboxed code execution. Untrusted submissions run in an isolated runner (no network, dropped capabilities, read-only FS, CPU/memory/time/process limits), on a separate execution tier from the web app.
  • Tenant and user isolation. Every query is scoped by user and organization; org data is reachable only by active members, and roles (admin / manager / member) gate privileged actions.
  • Audit logging. Admin, billing, and provisioning actions are recorded in an append-only audit log per organization.
  • No card data stored (reduced PCI scope). Payments use provider-hosted checkout (Razorpay for India, Stripe globally). We store only provider identifiers and subscription state, never card numbers.
  • Webhook integrity. Billing webhooks are signature-verified and processed idempotently, so replays and forged events are rejected.
  • Rate limiting. Submissions, contributions, ratings, and verification endpoints are rate-limited per user.
  • Input validation. Inputs are validated at the boundary; generated and user content is rendered as text to avoid injection.
  • SSO-ready provisioning (SCIM 2.0). Enterprises can provision and deprovision seats automatically via a token-authenticated SCIM 2.0 endpoint, with role mapping through SCIM Groups.

on the roadmap

  • SSO (SAML / OIDC). Per-organization single sign-on. Designed; pending integration with your identity provider.
  • SOC 2. Controls are being implemented to the Trust Services Criteria; the formal observation window and attestation (Type I then Type II) follow once operating history exists.
  • MFA on privileged accounts. Enforced MFA for admin and manager roles.
  • Encryption and backups. Encryption at rest and restore-tested backups with a defined RPO/RTO, finalized at the managed-hosting layer.
  • Independent penetration test. Third-party pentest with a shareable summary, before enterprise GA.
  • DPA and data residency. Data processing agreement and regional data residency options for enterprise contracts.

sub-processors

  • AnthropicProblem generation and verification (no-training / zero-retention API tiers)
  • RazorpayPayments and subscriptions (India)
  • StripePayments and subscriptions (global)
  • SheerIDStudent status verification (optional)
  • Managed Postgres / RedisApplication data, queues, and leaderboards

Print this page to save a PDF. For the security questionnaire, DPA, or SOC 2 status, contact your account team.