DriveState is a per-tenant training platform. Learner activity is stored against the tenant that paid for it, isolated from every other tenant, and never used to train any public AI model. This page summarizes how data moves through the system, what we keep, and what we don't.
The browser talks to a Next.js application hosted on Vercel, which in turn talks to a Postgres database (with the pgvector extension) hosted on Supabase. Learner audio is captured in the browser and streamed directly to Google's Gemini Live API; the AI counterpart's reply comes back through the same channel. When the avatar is on, the avatar's spoken text — and only the text — is forwarded over a separate WebSocket to LiveAvatar, which returns a rendered video stream to the browser.
Vercel and Supabase are both SOC 2 Type II certified. The default deployment region is the United States; an EU deployment is available for tenants with data residency requirements.
Every domain object — learner, session, turn evaluation, mastery score, content asset, content chunk — carries a tenant_id. Postgres row-level security policies ensure no query, including a malformed or malicious one from the application, can return rows across tenants. A new tenant gets its own row in the tenant table; all of its data hangs off that row via foreign key. There is no shared learner pool, no shared mastery pool, no shared content library.
The Supabase service-role key (the credential that bypasses RLS) is stored as a Vercel environment variable and is only ever read by serverless functions running server-side. The browser never sees database credentials. There is no public anon key in the client bundle.
The current demo environment is additionally protected by an access-code gate that an unauthenticated visitor cannot bypass — every backend API route is independently enforced by Edge middleware, not just the UI. Production deployments integrate with the tenant's identity provider (SAML, OIDC, or SCORM-tunneled SSO) so only authorized employees can sign in.
The learner record itself is intentionally minimal:
Per session, we store:
We do notstore demographic data, performance reviews, commission information, compensation, customer-facing sales records, or any data about the real customers the learner will eventually serve. The platform is a training simulator; it has no awareness of the learner's real-world transactions.
DriveState relies on three external services. Each one only receives the minimum data needed to do its job.
Processes learner audio in real time and returns the AI counterpart's reply. Also embeds query text for content retrieval. Per Google's published Generative AI API terms, content sent through the API is not used to train or improve Google's foundation models. The Google API is the only AI provider in the live conversation loop.
Receives plain text (the AI counterpart's next utterance), renders the avatar speaking that text, and streams the video back. Receives no learner identity, no email, no transcript, and no audio. LiveAvatar is invoked only when the avatar is enabled; in audio-only mode it is never called at all.
Stores tenant data (learners, sessions, mastery, authored content) and tenant asset files (coach videos, content snapshots). Encrypted at rest with AES-256; encrypted in transit with TLS 1.2+. SOC 2 Type II certified. The database is per-deployment, never shared across tenants other than at the schema level.
Serves the application bundle and runs the serverless API routes. Sees request metadata (URLs, headers, response codes) for operational logging but does not persist learner transcripts or mastery data. SOC 2 Type II certified.
Tenant data is retained for as long as the tenant is active. On contract termination, all tenant rows can be deleted in cascade — sessions, turn events, mastery, content assets, content chunks, asset files — leaving no residual data in our systems. The deletion is idempotent and operates entirely within the tenant scope.
Individual learner deletion (right-to-erasure) is supported at the application level: a learner's sessions, turn events, and mastery scores can be wiped in one call while preserving the tenant's aggregate analytics. Learner deletion is already an in-product action available to administrators.
The AI components in DriveState are all in the live conversation loop, never in the background:
A few choices are configurable rather than fixed:
Last updated: 2026-05-29. Questions or a request for a tenant-specific DPA? Email terry@1010development.com.