Security and data handling
What happens to a traffic export after you send it, and the controls you keep.
Your data trains your model only
Customer data is used exclusively to build and evaluate the models we train for you: evaluation sets, synthetic data generation, fine-tuning, and the cost report. It is never used to train models for anyone else.
You control what leaves your environment
Deployment follows your constraints: our cloud, your VPC, on-premise, or air-gapped. Under enterprise contracts, training and retraining run inside your environment, on your hardware, and nothing leaves it.
GDPR and data processing
distil labs is operated by Distil Labs GmbH in Berlin and works under the GDPR. A data processing agreement (DPA) is available for customers whose workloads contain personal data.
SOC 2™ Type 1 report
distil labs has received its first SOC 2 Type 1 report, on the design of our controls relevant to security, confidentiality, and privacy as of 19 October 2026. The examination was performed by the independent CPA firm Sensiba LLP. We are working towards a SOC 2 Type 2 report. Customers and prospects can request the report under NDA through our Trust Center.
Security review or procurement questions? Write tocontact@distillabs.aior see theprivacy policyandterms.