Security and privacy
Your customers' conversations stay on your own computer
DMAI Pro installs on the business's own computer. Messages, records, receipts and the built-in AI model all live there; a cloud AI is used only if you switch it on, and there is no central server holding your data.
Recorded from the real app.
Where the data lives
- Messages and records
- In a local database on that computer; account access keys are stored encrypted.
- The AI
- The language model is local; conversations go to no outside service unless you switch on a cloud model yourself.
- The public address
- An encrypted Cloudflare tunnel receives messages from Meta and Telegram; traffic goes straight to the business's computer.
- The admin panel
- It opens only on that computer and is not reachable from the internet. The phone app pairs with a one-time code.
Control over replies
- Numbers checked against a source
- Prices, hours, durations and every other number are compared with your saved information before sending.
- A customer's text is not an order
- A customer's message is data only; instructions hidden in it are not followed.
- Sensitive topics
- With the safety module on, emergency and medical messages get a fixed, safe reply and go to your team; without it the AI still gives no diagnosis or doses.
- Approval queue
- In manual approval mode, no reply goes out without your say.
Accounts and backup
- A required password
- Instagram and WhatsApp can be connected only after a panel password is set; sign-in locks for a while after several failed tries.
- Teammate roles
- Each teammate has an account with limited access; changing a role or password ends earlier sessions.
- Automatic backup
- The database is backed up automatically, and the latest copy stays in your Documents folder if the app is removed.
- App integrity
- The app's files are checked before they run; installing a new version keeps your data.
What leaves the computer, and what does not
| Data | Where | Leaves? |
|---|---|---|
| Customers' messages, comments, files and form answers | Encrypted database and media folder on your computer | No |
| Tokens, API keys and secrets | Encrypted on your computer; master key protected by Windows DPAPI | No |
| Local AI replies and voice-to-text | On this computer's processor | No |
| Backups | Encrypted, in the folder the owner chooses | No |
| Replies sent to customers | Meta (Instagram, WhatsApp) or Telegram | Yes |
| Incoming messages from the platforms | Pass through a Cloudflare tunnel, ngrok or the owner's domain; not stored there | Yes |
| Conversation text for cloud AI (only if the owner turns it on; names, phones, e-mails and cards replaced) | Anthropic, OpenAI or a compatible service, Google Gemini | Yes |
| Voice-reply text and the owner's voice sample (only if the owner turns it on) | ElevenLabs or Google Gemini | Yes |
| Fixed-address request (computer code and licence key) | Nexorah AI's address service (address.dmaipro.app) on Cloudflare | Yes |
| Update check and licence status list (no data sent) | Download from dl.dmaipro.app | Yes |
| Model and engine downloads (no data sent) | Hugging Face, GitHub, NuGet, nodejs.org | Yes |
| Phone-app notifications | Encrypted, through Google's, Apple's or Mozilla's push service | Yes |
| Customer payment details (if the business connects a gateway) | The payment gateway the business chose | Yes |
| Usage statistics, crash reports, telemetry | Not sent | No |
Official connections, no account passwords
Instagram and WhatsApp connect through a Meta app and Telegram through an official bot. No account password is ever entered or stored.
