Security and privacy are foundational to how Duet is built. Here is how we protect data across the service.
Duet stores account, workspace, session, and billing metadata in its managed control plane. Each workspace also receives a dedicated cloud VM for its files and agent processes. Workspace credentials are scoped to that workspace, and the product API enforces membership and role checks before data is returned or changed.
Duet uses several specialized providers: Convex for managed application data, Vercel for the web and API delivery layer, and exe.dev for dedicated workspace VMs. Model providers and optional integrations process only the requests needed when you use those services.
Authenticated workspace members can access data according to their role. API keys and integration connections work only with the capabilities and workspace you authorize. Internal administrative access is separately restricted and audited.
Duet does not use your workspace content to train its own models. Requests sent to a selected model provider are governed by that provider’s commercial API terms and data controls, so you should review the terms for the models you choose.
Infrastructure providers operate the systems that store or transmit data under their own security controls and contractual terms. Duet limits each provider to the role it performs and isolates workspace files and processes in a dedicated VM rather than a shared workspace runtime.
Duet systems process workspace content to run the service. Authorized operators may access limited data when needed for support, security, abuse prevention, or reliable operation, subject to access controls and audit records. Duet does not sell or rent your workspace content.
Duet uses TLS for data in transit and the at-rest protections supplied by its managed infrastructure providers. Browser session credentials stay in secure, HTTP-only cookies; workspace and VM credentials are scoped and time-bounded; integration credentials remain on server-side provider boundaries rather than being exposed to browser JavaScript.
You can delete individual sessions, apps, files, training records, and other supported resources from the product. You can also disconnect integrations to revoke future access. For account, workspace, or broader data deletion requests, contact team@duet.so.
Have more questions about how we handle your data? Reach out at team@duet.so