Security & Privacy at Dimension Technology Solutions
Dimension Technology Solutions, Inc. (“DTS”) builds and supports software for our clients. We take the security and privacy of the information entrusted to us seriously, and this statement explains, in plain terms, how we protect it.
The information we handle
DTS is a business-to-business software development and support company. We do not operate a public, consumer-facing product that collects personal information at scale. The information we handle is:
- Business contact information — details you provide when you contact us or that we exchange with clients, vendors, and partners in the course of business.
- Client information we access to deliver services — our clients host their own data in their own environments; when our work requires access to that data, we handle it under contract and only as needed to provide the service.
How we protect it
- Strong access controls — multi-factor authentication is required across our business accounts, access is granted on a least-privilege basis, and access is reviewed periodically and promptly removed when no longer needed.
- Encryption — company devices are full-disk encrypted, and data is protected in transit and at rest using industry-standard encryption.
- Secure development — changes to software are reviewed and approved through a documented change-management process before release.
- Vendor diligence — we rely on established providers (Microsoft Azure, Microsoft 365, and Atlassian) and review their security and compliance posture.
- Incident response — we maintain an incident response plan with defined procedures for detecting, handling, and — where required — notifying affected parties and authorities of security incidents.
- Independent assurance — DTS's security program is built to the AICPA SOC 2 Trust Services Criteria, and a SOC 2 Type I examination is in progress with a licensed CPA firm.
Client data
Our clients own their data. When we access client data to provide services, we protect it under the terms of our client agreements and confidentiality obligations, handle it according to our internal data-classification standards, and do not sell it or use it for any purpose other than delivering the agreed services.
Website information
If you contact us through our website or by email, we use the information you provide solely to respond to your inquiry and to conduct our business relationship. We do not sell personal information. We retain it only as long as needed for those purposes and in line with our records-retention practices.
Website chat assistant
Our website offers Alpaca, an AI chat assistant that answers questions about DTS. When you use it, the messages you type are sent to our AI service providers, Anthropic (which generates the answers) and TypeSafe AI (which screens messages for misuse), to process your request. We record chat transcripts so we can follow up on business inquiries, improve the assistant and prevent abuse. We do not store your IP address; we keep a one-way coded identifier derived from it so we can enforce usage limits, along with the name of the network it belongs to (for example, your company or internet provider) and its approximate location (state or region and country), looked up on our own servers. With a chat we also record how you arrived at our site (the referring site and any campaign tags), your browser's language and its time zone. If you use voice, your speech is sent to OpenAI, which converts it to text and speaks Alpaca's answers; we keep the text transcript, not the audio, and ask OpenAI not to store the session. Transcripts are stored in Microsoft Azure and retained in line with our records-retention practices. Please don't share sensitive personal information in the chat. Network and country lookups use IP Geolocation by DB-IP.
Alpaca Analysis sandbox
If you open our hands-on Alpaca Analysis sandbox page after chatting with Alpaca, we note on that chat's record when you opened the page and whether you clicked to start a sandbox. The sandbox itself is a separate service at demo.dts-global.com, and its start page explains how it works: it is private to you for 24 hours, and everything you make in it is deleted when it ends. With the record of each sandbox, it keeps a one-way coded identifier derived from your IP address, never the address itself, so it can limit how many sandboxes are started from one network and how much is spent running them. That record, identifier included, is deleted 30 days after the sandbox itself is deleted.
If the sandbox asks for your name and email before it starts:
- What we collect — your first name, last name and email address, and when you used the sandbox, along with the coded network identifier above.
- Why — to confirm your email address, to let our team know in Slack that someone tried the sandbox, and so we may follow up with you about Alpaca.
- Confirmation email — we send a confirmation link from demo@dts-global.com through Microsoft 365. If your email isn't confirmed within about an hour of our first email, the sandbox pauses until you click the link.
- How long we keep it — your name, email address, when you used the sandbox and the coded network identifier stored with them are kept for 24 months after your sandbox ends, then deleted. Everything you make in the sandbox is still deleted when it ends.
- Deletion on request — to have your details deleted sooner, email us at ryan.morgan@dts-global.com (see Contacting us below).
Contacting us
If you have a security or privacy question, or wish to report a concern, please contact us at ryan.morgan@dts-global.com, Dimension Technology Solutions, Inc., 7931 S Broadway, Littleton, CO 80122.
Updates
We may update this statement as our practices evolve. The effective date above reflects the current version.