Security and data handling, stated plainly.

Your data stays inside your perimeter.

Every Doradus product runs on your hardware, inside your perimeter. There is no multi-tenant platform behind it and no vendor cloud holding a copy of your operation. When a product needs data, it reads it on site, and the results stay on site.

The same posture governs services work. We have engineered casino IT, security, and surveillance since 2011, for tribal Class II and Class III properties and commercial casinos, and the pattern has not changed: the work happens on your systems, under your rules.

• No automated action against people. Our products surface findings for your staff to act on. Every finding is explainable: it shows its evidence and its limits.
• People decide. Nothing we build moves a machine, sends an offer, or flags a person without a human in the loop.

We do not name clients. Ever.

Our OptiFloor page says the product is in live pilot at two sister-property pilot casinos in Colorado, and stops there. That is not coy marketing. It is policy. We do not publish client names or logos, and we do not imply identities. No player data appears in anything we publish, and the OptiFloor validation was designed so it never has to: the numbers come from replaying each property's own history, and what we cite publicly is the measurement, never the data.

If we will not talk about other casinos to win your business, you can be confident we will not talk about yours to win the next one.

How this site measures traffic.

A trust page should account for itself. This site uses first-party analytics only. Visits are stored in SQLite on our own server. That is the whole pipeline.

The same discipline applies to product telemetry: there is none. Nothing we ship phones home.

Practices we commit to.

We will not dress these up as certifications. They are policy commitments, and we are glad to put them in writing in your engagement contract.

• Named accounts, never shared. Anyone from Doradus touching your systems does so under an individual, attributable account that you control and can revoke.
• Least privilege, in writing. We request the narrowest access the work needs, document why, and expect it removed when the work ends.
• Your data stays yours. We do not copy production data off your premises for development, testing, or demonstrations.
• Changes are reviewed. Code and configuration changes to systems we run for you go through review before they reach production.
• Remote access on your terms. When remote work is needed, we connect through channels you provision and can monitor, not tunnels we control.

No badge wall.

We do not hold a SOC 2 attestation, and we will not imply one with careful wording. Here is what we do instead. Our products run on your hardware, so the controls that matter most are the ones you already audit: your network, your access policies, your physical security. We add the access commitments above, contractual terms that back them, and direct answers: send us your due-diligence questionnaire and a senior engineer will complete it, question by question, with no portal in the way.

Architecture and data-handling documentation is available under NDA as part of a briefing. We would rather show our work to your compliance team than show a logo to everyone else.

This page summarizes current policy for Doradus Labs of Golden, Colorado. It is written to be forwarded. If anything here conflicts with an executed contract, the contract governs.