Is Dust safe with your data?

No-training commitment is limited to the model vendors

The policy says the foundational model providers it names, including OpenAI, Anthropic, Mistral, Google and Fireworks, are prohibited from using customer and personal data for model training and apply a Zero Data Retention policy. It makes no equivalent statement about Dust's own use of platform data, and it names no opt-out or opt-in control a user could exercise.

Retention runs for years and the policy stops there

Personal data is kept for the agreement duration with customers and then archived for five years, with marketing data kept three years from last contact. The policy names no shorter retention for AI logs or prompts, and it never says how long deletion takes once an account or contract ends.

Security is described in adjectives, with no breach notice

The policy promises industry-standard physical, procedural and electronic measures and an encrypted database, but it names no encryption standard or access-control framework. There is no breach notification commitment anywhere in the text, and no named certification such as SOC 2 or ISO 27001.

Rights and transfers are concretely documented

The policy enumerates access, deletion, correction, restriction, portability, objection and consent withdrawal, routes them to privacy@dust.tt and a Data Protection Officer at dpo@dust.tt, and names Standard Contractual Clauses and European Commission adequacy decisions as the safeguards for transfers to the United States.