Your research stays yours.
Devirt processes account details, uploaded binaries, results, billing references, and audit records to provide your requested service. Samples are not used to train models or populate the curated database. Paid orders and paid uploads are processed only through the configured commercial services.
Customer separation
Each upload receives its own customer-scoped storage location. Processing is assigned to an isolated service with no shared customer state. Analysis infrastructure must be network-isolated during execution. Platform storage, billing, and notification traffic remains separate from binary execution.
Retention
- Automated inputs: deletion begins after processing finishes and output is made available.
- Unpaid uploads: retained for up to 24 hours before expiration and deletion.
- Assessment inputs: retained through assessment and the 72-hour offer window. Declining triggers deletion; accepting transfers retention to the engagement.
- Released output: retained for 72 hours by default or 30 days on Team. Novel output awaiting final payment has a separate 72-hour payment window.
- Triage Plus summaries: retained for 30 days after release.
- Processing audit logs: retained for 90 days and exportable by the customer.
- Enterprise contact requests: retained for 90 days unless a separate relationship requires another documented schedule.
Account and billing records follow the applicable account relationship and required financial retention. Curated entries are separately licensed material.
Optional email updates
Devirt availability updates and member offers require a separate request and email confirmation. The weekly research digest is an additional, optional choice. Creating an account or contacting the team does not subscribe you. Every marketing message includes an unsubscribe link; withdrawing consent does not stop account or analysis notifications.
We retain your email preferences and a record of the consent wording, version, and confirmation or withdrawal. A minimal suppression record prevents accidental re-enrolment. Email content queued for delivery is encrypted at rest. Our email provider receives the address and message needed to deliver it. Binaries are never included. Request access or deletion through the contact form; suppression and consent evidence may need to remain to respect your choices or meet applicable obligations.
Security and subprocessors
Storage uses server-side encryption and time-limited links. API keys are hashed; production sessions use secure, HTTP-only cookies. A crypto payment provider creates payment addresses and forwards cryptocurrency to Devirt. Transactions and wallet addresses may be visible on public blockchains and cannot be deleted from them. We do not hold your wallet keys. The transactional email provider delivers account and analysis notifications. Binaries are not attached to emails.
Processing and storage locations depend on the configured infrastructure and service providers. Devirt does not promise a specific data-residency region at this time. Locations, subprocessors, transfer safeguards, and any enterprise data-processing agreement must be disclosed and agreed before you submit commercial data.
Your choices and rights
Request access, correction, deletion, portability, restrictions, or an objection through the contact form. You can also complain to your applicable supervisory authority. Some records may be retained for legal obligations or claims. Requests are handled after account ownership is verified.
Enterprise deletion evidence
A certificate becomes available after storage and processor deletion confirmations. Audit records remain subject to their disclosed retention. A certificate is not issued merely because deletion was requested.
EU data handling
Enterprise processing, international transfers, and customer-specific deletion or residency requirements require a written review before transfer.