# Security and compliance

> Dimension Labs certifications and deployment options, inviting users, single sign-on, the personal information policy, and how data is removed.

| | |
|---|---|
| Certifications | SOC 2 Type II, ISO 27001 |
| Privacy | GDPR compliant. We sign customer data processing agreements (DPAs). |
| Deployment | Cloud hosted, multi-tenant or single-tenant |
| Access | Invited users only, with role-based permissions. Single sign-on (SSO) on an enterprise contract. |
| Ingestion | Integrations, the universal API, and file uploads |

For our security overview, see [dimensionlabs.io/security](https://www.dimensionlabs.io/security). For plans and prices, see [pricing](https://www.dimensionlabs.io/pricing).

## Contact

- **support@dimensionlabs.io** for all help: setup, uploads, data, users, SSO, login and billing.
- **hello@dimensionlabs.io** only for security questionnaires, DPAs and audit reports.

## Users

People join your organization by invitation.

1. Open the **User management** page.
2. Invite each person by email.
3. Check the list. **User management** shows both invited and active users, so you can see who has accepted an invitation and who hasn't.

To add several people at once, or to change a person's role and what they can do, email support@dimensionlabs.io.

## Single sign-on

SSO is available on an enterprise contract and is set up with Dimension Labs. To start, email support@dimensionlabs.io with your identity provider's name.

## Personal information

Dimension Labs has a policy of not ingesting or storing any personal information (PII). Keep it out of what you send:

- **Don't use personal information as an id.** Never use an email address, phone number or name as `userId`, `sessionId` or a join key. Use your tool's internal ids. To join on email, use a consistent hash of the email, the same hash on both sides.
- **Don't send it as metadata.** Leave personal fields out of `platformJson` and out of the extra columns in your files.
- **Redact the text** before you upload or send it. See [PII redaction](/data/pii-redaction).
- **Check outputs before you share them.** A published artifact can be opened by anyone with its link, so read the quotes in a report before you publish it. See [Share it](/outputs#share-it).

## Removing data

There is no self-serve delete of individual records. To remove data:

- **Start clean.** Create a new integration and use that one instead.
- **Remove specific data.** Email support@dimensionlabs.io for a targeted deletion on an integration. Say which source, and which conversations or date range.

Re-sending or re-uploading the same data is safe: duplicates you send or upload are removed automatically by ingestion. To take down a shared report, [revoke its link](/outputs#revoke-a-link).