Skip to content
AYBIZA
Sign in Start free

Security & Compliance

Last updated: July 30, 2026 | Effective: July 30, 2026

This page describes how AYBIZA protects your data. Everything here is in the platform today; where something is planned rather than built, we say so.

It is a summary for readers, not a contract. The binding security commitments are in Schedule 2 of our Data Processing Agreement, which we may not weaken without maintaining an equivalent level of protection.

Tenant isolation

Every organization’s data is isolated at the database layer. Isolation is not a filter the application has to remember to apply — the database enforces it on every query, and a request without a valid organization context returns nothing rather than everything. A mistake in application code cannot leak another customer’s data.

Access control

  • Roles and granular permissions, default-deny: an action not explicitly granted is refused, and refusals are recorded.
  • AI agents are separate principals. An agent holds its own identity and permissions. It does not inherit the permissions of whoever configured it and cannot be elevated to administrative access.
  • Approval gates on privileged actions — merging customer records, publishing or rolling back an agent, exporting or erasing personal data — with re-confirmed multi-factor authentication on the most sensitive.
  • Multi-factor authentication, available to every user and enforceable across an organization.
  • Single sign-on through SAML 2.0.
  • Scoped API keys, rotatable and revocable, alongside short-lived session tokens.
  • IP allowlisting to restrict access to approved ranges.

Encryption

Your data is encrypted in transit and at rest with AES-256-GCM. Provider credentials, call recordings, telephony identifiers, and multi-factor secrets carry an additional layer of per-record encryption, each protected by its own data key rather than a shared one. Keys are rotatable. Credentials you supply are encrypted before storage and never written to logs.

Audit logging

Tamper-evident, append-only audit trails record access, data changes, configuration changes, authentication events, and administrative actions — for people and AI agents alike. Permission denials are recorded too, so an attempt to exceed authority is as visible as an action taken. You can query and export your own audit trail.

Audit records are retained for security and regulatory purposes rather than deleted on request. They identify people by internal account reference, and that account is anonymized when erasure is requested.

Your data rights

Export your content in machine-readable form at any time, and for 30 days after your subscription ends. Erasure requests are executed against the platform rather than handled by hand. Retention windows are set out in our Privacy Policy.

Availability and resilience

Rate limits protect the platform under load and fail secure, so an attack degrades access rather than exposing data. Continuous backups with point-in-time recovery guard against infrastructure failure, with a separate restorable copy held by a second cloud provider in the same jurisdiction as the data it protects.

Sub-processors

Every provider we rely on is named, with its role and location, in the sub-processor schedule. We give at least 30 days’ notice before adding or replacing one, and you may object on reasonable data protection grounds. When you bring your own provider keys, that provider is not our sub-processor — the relationship is yours.

Payments

Billing is handled by a PCI Level 1 service provider. AYBIZA never stores, processes, or transmits raw cardholder data.

Compliance

  • SOC 2. Our architecture is designed following the SOC 2 Trust Services Criteria; a third-party assessment is planned. We do not claim certification we do not hold.
  • GDPR. Our Data Processing Agreement covers data subject rights, transfer mechanics, sub-processors, and processing terms.
  • Telephony. Outbound calling is governed by our Acceptable Use Policy, including consent, do-not-call, calling hours, and AI disclosure.

Responsible disclosure

Report a vulnerability to security@aybiza.com. We acknowledge receipt within 24 hours and keep you updated through resolution. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate before disclosing.