Format follows a CAIQ-Lite / SIG-Lite style. Reuse rows verbatim
when responding to a customer's questionnaire — every answer is
linked to source-of-truth code or docs in this repo.
Self-hosted only. Operator deploys to their own infra (laptop / NGO office / cloud / k8s). The Duecare authors do not operate any service that customer data passes through. See docs/deployment_topologies.md.
A2
What's the licensing model?
MIT. The source workspace package surfaces, Docker image, Helm chart, and Android repo are MIT. Gemma 4 model weights are Apache 2.0; see the Gemma Terms of Use.
In whatever store the operator deploys to. Topology B/D = on-prem. Topology C = operator's cloud account. The Duecare maintainers do not have access to any customer data.
B3
Is data encrypted at rest?
On Android (Topology D): SQLCipher with key in Android Keystore. On server (evidence-db, audit log): operator's responsibility — Postgres TDE / RDS encryption / GCP CMEK / Azure Key Vault.
B4
Is data encrypted in transit?
TLS 1.3 at the edge. Mutual TLS between cluster pods is recommended via service mesh (Istio / Linkerd / Cilium).
Default 90 days for the audit log; configurable via DUECARE_AUDIT_RETENTION_DAYS. Journal is unbounded — operator chooses.
B7
Can customer data be deleted on request?
Yes. DELETE /tenant/{id}/data in duecare-llm-server; Settings → Panic wipe in the Android app. Both are immediate + irreversible.
B8
Is data exportable on request?
Yes. GET /tenant/{id}/data?format=ndjson; Reports tab → "Generate intake document" in Android.
B9
Do you cross-border transfer customer data?
No — Duecare doesn't transfer data across borders (we don't operate the service). Operator's cloud-region choices control residency.
B10
Sub-processors?
Zero by default. Only present when operator opts in: cloud-Gemma routing (Ollama / OpenAI / HF Inference) + internet search (Tavily / Brave / Serper). All listed in .env.example with explicit env-var enablement.
None — self-hosted, no Duecare SaaS dependency. Forking the open-source repo is the long-term mitigation.
H2
Pricing model?
Free + open source. No per-seat / per-call / per-token fees from Duecare. Operator pays for their own model + cloud compute.
H3
What sub-processors charge?
Tavily \(0-\)N/1k queries; Brave Search \(0-\)N/1k; Serper \(0-\)N/1k; OpenAI / Anthropic / Gemini per published rates. Local Gemma via Ollama: $0.
H4
Cost ceiling for a typical 1000-user-month deployment?
$0 with Ollama + local-only; $5-50/mo for a Render-hosted Topology C; $75-500/mo for a managed K8s + GPU pool. See docs/considerations/capacity_planning.md.
This file is published verbatim — operators may copy it into their
internal procurement workflow without modification.
When responding to a customer's bespoke questionnaire:
Open this file + the customer's PDF / spreadsheet
For each customer question, find the closest row above
Copy the answer + cite the source (this repo's URL + doc path)
Where Duecare doesn't have an answer, mark "operator
responsibility" + cite which doc explains the operator hand-off
For new questions worth answering more than once, file a PR adding
a row here. The benefit compounds: every future operator gets a
faster procurement cycle.