Security

• CASA Tier 2 Certified: The Drive AI has completed the Cloud Application Security Assessment (CASA) at Tier 2, independently verified by a Google-authorized lab. This covers secure data handling, authentication, access control, and vulnerability management.
• ESIGN Act Compliant: Our electronic signature feature meets the requirements of the U.S. Electronic Signatures in Global and National Commerce Act.
• PCI DSS (via Stripe): All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. We never store card data on our servers.

The Drive AI runs on enterprise-grade cloud infrastructure with built-in redundancy, automated failover, and continuous monitoring.

• Cloud hosting: Our infrastructure is hosted on industry-leading cloud providers with SOC 2 Type II and ISO 27001 certifications.
• Network isolation: Production environments are isolated with strict firewall rules and private networking. Access is restricted to authorized services only.
• DDoS protection: We use enterprise-grade DDoS mitigation to ensure platform availability.
• Uptime monitoring: Automated health checks and alerting ensure rapid response to any service disruptions.

Your files and personal data are encrypted both in transit and at rest.

• In transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints.
• At rest: Files and database records are encrypted using AES-256 encryption. Encryption keys are managed through a dedicated key management service with automatic rotation.
• Backups: All backups are encrypted using the same standards as production data and stored in geographically separate locations.

• OAuth 2.0: We support secure authentication through Google, Microsoft, and Apple sign-in providers. We never store your third-party passwords.
• Session management: Sessions are securely managed with automatic expiration and revocation capabilities.
• Role-based access: Team accounts use role-based access controls to ensure members only access files they are authorized to view.
• Internal access: Employee access to production systems requires multi-factor authentication, and follows the principle of least privilege. All access is logged and audited.

• Minimal data sharing: When AI features process your files, only the specific content needed to complete the task is sent to the AI provider. No account metadata or personal information is included.
• Contractual protections: We maintain agreements with all AI providers that prohibit them from retaining or using your data beyond the immediate request.
• Optional AI features: AI-powered features are optional. You can use The Drive AI for file storage and organization without enabling AI processing.

• Isolated storage: Each user's files are stored in isolated containers. There is no cross-account access at the storage layer.
• Secure sharing: Shared files use signed, time-limited URLs. You control who can access your files and can revoke access at any time.
• Permanent deletion: When you delete files, they are permanently removed from our systems. We do not retain deleted file data.
• Upload validation: All uploaded files are scanned and validated to prevent malicious content from entering the platform.

We do not store credit card numbers, CVVs, or other sensitive payment information on our servers.

• Stripe: All web payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor.
• Mobile payments: In-app purchases are processed securely through Apple App Store and Google Play Store.

We maintain an incident response plan to handle security events promptly and transparently.

• Monitoring: Continuous logging and anomaly detection across all systems.
• Notification: In the event of a data breach, affected users will be notified within 72 hours as required by applicable regulations.
• Post-incident review: Every security incident is followed by a root cause analysis and remediation to prevent recurrence.

If you discover a security vulnerability, we encourage you to report it responsibly. Please contact us at contact@thedrive.ai with details of the issue. We will acknowledge your report within 48 hours and work to resolve confirmed vulnerabilities promptly.