Security

How Draft & Goal secures your data and workflows: TLS 1.3 and AES-256 encryption, per-organization data isolation, OAuth token protection, and SAML SSO.

Overview

Draft & Goal is built with security at its core. We understand that your workflows handle sensitive business data, and we take protecting it seriously.

GDPR compliant Personal data protection
SOC 2 Type II Audited controls
ISO 27001 Information security
TLS 1.3 · AES-256 Encryption in transit and at rest
OAuth Google / Microsoft integrations
SAML SSO Enterprise authentication

Data protection

Encryption

  • In transit: All data is encrypted using TLS 1.3
  • At rest: Data encrypted using AES-256

Data isolation

  • Each organization has isolated data storage
  • No cross-organization data access
  • Strict access controls

Data retention

  • Detailed execution outputs expire after a retention window (about 2 months for production runs; 30 days for some builder outputs). Metadata and inputs remain available longer.
  • You can delete your Studio content at any time: workflows, integrations, members, and other organization resources, according to your access rights.

Authentication

Studio sign-in

Sign-in to Draft & Goal goes through Zitadel:

  • Email and password — default method for members invited with classic authentication
  • Enterprise SSO — via your identity provider (IdP) when your organization has configured it
  • Session management with secure tokens

When inviting members, Admins choose email/password or SSO. See Members & invitations and Teams & Collaboration.

Studio API keys

  • API keys with a dedicated API role
  • Optional expiration date at creation
  • Create and delete by Admins

Enterprise features

For larger organizations, Draft & Goal supports enterprise identity options (contact sales for availability on your plan):

  • SAML 2.0 SSO — authenticate via your identity provider
  • Authentication rules configurable via your IdP (SSO) — sign-in policies enforced on the identity side
Info

Organization-wide audit log UIs and fully custom permission roles are not exposed as Studio pages today. For compliance needs beyond role-based access and SSO, contact sales or security@dng.ai.

Integration security

OAuth connections (integrations)

Third-party integrations (Google, Microsoft, etc.) use OAuth — separate from Studio sign-in via Zitadel:

  • We never store your third-party service passwords
  • Tokens encrypted at rest (AES-256)
  • Automatic token refresh
  • Revoke access anytime from integration settings

Integration credentials

  • Encrypted storage of keys and tokens
  • Never logged in plain text
  • Access limited to the scope of the relevant integration

Infrastructure

Cloud hosting

  • Hosted on secure cloud infrastructure
  • Geographic redundancy
  • Regular security audits

Monitoring

  • 24/7 infrastructure monitoring
  • Anomaly detection
  • Incident response procedures

Compliance

Standards

  • GDPR compliant
  • SOC 2 Type II
  • ISO 27001
  • Regular penetration testing
Trust Center

View our certifications, security policies, and compliance documentation on the Draft & Goal Trust Center.

Data processing

  • EU data processing available
  • Data processing agreements
  • Subprocessor transparency

Best practices

For your workflows

  1. Use environment variables for sensitive data
  2. Limit the number of active API keys to what’s needed
  3. Review integrations regularly
  4. Monitor execution logs for anomalies

For your team

  1. Use strong passwords or SSO
  2. Enable 2FA when available
  3. Review member access quarterly
  4. Offboard promptly when needed

Reporting issues

Security vulnerabilities

If you discover a security vulnerability, please report it to:

security@dng.ai

We take all reports seriously and will respond within 24 hours.

Questions?

Contact Security Team

Email us with security questions or concerns