Encryption in transit and at rest
Traffic is protected with TLS in transit. Data at rest is protected with AES-256. Language here describes the security model we build to — not a completed third-party audit.
Security & privacy
Built for distributors who won’t hand over control of their margins — or their data.
These are the claims we stand behind today for the Dystra AI product we are building. We do not invent certifications we have not earned.
What we stand behind
Six commitments, stated plainly.
Tenant isolation
Each distributor’s environment is isolated. Your catalogs, pricing, and customer records are not mixed with another company’s data.
You own your data
Customer data remains the customer’s. Dystra AI is a processor for your quoting workflow — not a reseller of your commercial data.
We do not sell your data
We do not sell customer RFQs, catalogs, pricing, or account data to third parties.
No shared-model training on customer RFQs
We do not train a shared model on your RFQs for other customers. Your documents are used to serve your company.
Human approval before anything posts
Quotes and orders do not go to a customer or into your ERP until a person approves them. Deterministic pricing rules and margin floors stay under your control — pricing is never left to AI math.
Honest “not yet”
What we do not claim today
Trust pages that over-promise get distributors burned. Until these are real, we will not list them as capabilities:
SOC 2
Not yet. Larger distributors often ask for a SOC 2 report before connecting an ERP — we treat that as a planned bar, not a current badge.
Penetration test
Not yet. We will not claim an independent pen test until one has been completed.
SSO / SAML
Not yet. Single sign-on is a later enterprise requirement, not a v1 claim.