Dex

No public status page, SLA, incident-history page or breach-notification commitment was found. Availability is described only as commercially reasonable efforts. A Vulnerability Disclosure Programme exists but is operated as a Google Form intake (link in the site footer) rather than a security.txt, dedicated security contact or bug bounty; the form returns 401 to unauthenticated fetches and could not be reviewed. Product changes are communicated through a public changelog and a feedback/roadmap portal. Regulation CF annual reporting to the SEC lapsed after the FY2022 Form C-AR, so no current audited or self-reported financial monitoring is available.

Open items from the 2026-07-31 desk review: (1) SOC 2 and ISO 27001 are claimed for the hosting providers, not for Dana HQ Inc itself; no vendor-held certification, audit report or pen-test summary is published. (2) The Terms of Service were last modified 2022-02-08 while the Privacy Policy was updated 2026-07-23, so the contractual layer lags the privacy layer by more than four years. (3) No public DPA, standard contractual clauses, sub-processor register with change notification, or GDPR Article 27 EU representative. (4) All hosting is stated to be in the US, with no EU data residency option; international transfers are described generically. (5) Micro-entity concentration risk: 2 employees and roughly 18 months of runway at the last public filing (Feb 2023), negative equity, funded via SAFEs and Reg CF. (6) Liability is capped at fees paid in the preceding 12 months and the Terms expressly disclaim any guarantee of privacy or security. (7) Third-party advertising networks collect web-behaviour data on the marketing site; Google user data is ring-fenced from advertising, but the position on other synced data is less explicit. (8) No registered patents or trademarks; IP rests on trade secrets. (9) The registered address is a suite-number mail-forwarding style address rather than an operating office. (10) The underlying AI model providers behind the assistant features are not publicly named.