Trust & Security at Duet

Access to Duet requires a signed-in account. We support email and password sign-in and Google as a single sign-on provider. Sessions are managed by our authentication provider and tokens are stored in your browser's standard storage.

Workspace data is scoped to the workspace a user is a member of. Roles (workspace admin vs. member) determine what each user can change.

Every workspace's records are isolated at the database layer using row-level security policies, so users only see rows that belong to a workspace they're a member of.

Sensitive operational fields — such as the workspace admin's contact email, API token hashes, and invitation tokens — are not exposed to regular workspace members, even within their own workspace.

Traffic between your browser and Duet, and between Duet and the providers we use, is encrypted in transit using TLS.

Security in Duet is a shared responsibility. Duet operates the application, applies access controls, and runs automated security scans on the codebase. Customers are responsible for keeping their account credentials safe, choosing appropriate workspace roles for teammates, and reviewing the third-party integrations they connect.

Duet uses third-party providers to host the application, store data, send transactional email, and run AI models that power features like the Marketing Brain. When you upload assets or generate content, the relevant text or files are sent to these providers solely to fulfill your request.

If you need a current list of subprocessors or a Data Processing Addendum for your organization, contact us at the address below.

If you believe you've found a security issue in Duet, please email security@letsduet.ai with a description and steps to reproduce. We review reports promptly and will follow up to acknowledge receipt.

This page does not constitute a warranty, certification, or legal commitment. For contract terms, see your agreement with Duet.