Legal

Security at Foyla.

Last updated: September 2026

This page describes how we protect client data and the systems we build. Procurement and security teams can request our current security documentation, questionnaire answers, and subprocessor list at [email protected].

How we think about it

The systems we build run inside our clients' environments and act on real data. We design them the way a security team would want a new internal system designed: least privilege, a complete audit trail, human review on anything new, and a fast path to stop or roll back. We apply the same standard to our own access while we build.

Where the software runs

By default, delivered systems are deployed in the client's own cloud account, on-premise environment, or VPC. The client owns the infrastructure, the data, and the access controls.
Where a client asks us to host, we use a major cloud provider in the United States with a separate account, storage, and secret scope per client. EU region available on request.
Foundation-model calls, where a system uses them, go to providers under enterprise terms that exclude training on the data sent. The client chooses the provider and can route through their own account.

Data protection

Encryption in transit (TLS 1.2+) and at rest (AES-256) for every system we build and every system we operate.
Client credentials and API keys are stored in a dedicated secrets manager, scoped to the system that needs them. They are never stored in code, tickets, or chat.
Production data stays in production. Development and testing use synthetic or anonymized data unless the client agrees otherwise in writing.
Client data is not used to train models for other clients or for Foyla.

Access during the build

Our engineers work inside the client's environment on accounts the client issues and can revoke. Access is scoped to the systems in the Statement of Work.
SSO and multi-factor authentication on all Foyla internal systems. Production access at Foyla is just-in-time and tied to a ticket.
All access to client environments is logged on the client side and reviewable by the client at any time.

The delivered system

Every production action is written to an audit log the client owns and can query.
AI steps, where present, run within limits set in configuration. Their output can be routed to a human review queue before it takes effect. Deterministic steps run as plain code with no model in the loop.
Rollback is built in from the first release. Every deployment can be reverted to the previous version.
On handover, the client receives the source code, deployment scripts, documentation, and monitoring, so the system can be operated without Foyla.

Vulnerability management

Automated dependency scanning on every build. Known vulnerabilities are triaged and fixed on defined internal timelines before release.
Responsible disclosure: report a vulnerability to [email protected] with "Security" in the subject line and we will acknowledge within one business day.

Business continuity

For systems deployed in the client's environment, backups follow the client's existing policy, and we document what needs to be backed up and how to restore it.
For systems we host, we use the cloud provider's managed backups with a documented restore procedure.
Documented incident response process with severity levels, escalation, and client communication paths.

Security roadmap

We are an early-stage company and say so plainly. The following controls are on our near-term roadmap rather than already certified. We will update this page as they ship.

SOC 2 Type II: target audit period starting H2 2026.
ISO 27001: scoping in parallel with SOC 2.
Third-party penetration test of our internal systems: planned for H2 2026.
Documented restore drills for hosted systems: planned alongside our first hosted enterprise deployment.
Subprocessor change notification subscription.

If any of these are a gating requirement for you, let us know. We can often commit to a timeline in the Software Development Agreement.

Compliance

US state privacy laws (CCPA/CPRA, Colorado, Connecticut, Virginia, Utah) and GDPR/UK GDPR are addressed in our Privacy Policy and DPA. SOC 2 and ISO are on the roadmap above.

Contact

Security questions and vulnerability reports: [email protected]