# Security at Foyla.

Last updated: September 2026

> This page describes how we protect client data and the systems we build. Procurement and security teams can request our current security documentation, questionnaire answers, and subprocessor list at [legal@foyla.ai](mailto:legal@foyla.ai).

## How we think about it

The systems we build run inside our clients' environments and act on real data. We design them the way a security team would want a new internal system designed: least privilege, a complete audit trail, human review on anything new, and a fast path to stop or roll back. We apply the same standard to our own access while we build.

## Where the software runs

- By default, delivered systems are deployed in the client's own cloud account, on-premise environment, or VPC. The client owns the infrastructure, the data, and the access controls.
- Where a client asks us to host, we use a major cloud provider in the United States with a separate account, storage, and secret scope per client. EU region available on request.
- Foundation-model calls, where a system uses them, go to providers under enterprise terms that exclude training on the data sent. The client chooses the provider and can route through their own account.

## Data protection

- Encryption in transit (TLS 1.2+) and at rest (AES-256) for every system we build and every system we operate.
- Client credentials and API keys are stored in a dedicated secrets manager, scoped to the system that needs them. They are never stored in code, tickets, or chat.
- Production data stays in production. Development and testing use synthetic or anonymized data unless the client agrees otherwise in writing.
- Client data is not used to train models for other clients or for Foyla.

## Access during the build

- Our engineers work inside the client's environment on accounts the client issues and can revoke. Access is scoped to the systems in the Statement of Work.
- SSO and multi-factor authentication on all Foyla internal systems. Production access at Foyla is just-in-time and tied to a ticket.
- All access to client environments is logged on the client side and reviewable by the client at any time.

## The delivered system

- Every production action is written to an audit log the client owns and can query.
- AI steps, where present, run within limits set in configuration. Their output can be routed to a human review queue before it takes effect. Deterministic steps run as plain code with no model in the loop.
- Rollback is built in from the first release. Every deployment can be reverted to the previous version.
- On handover, the client receives the source code, deployment scripts, documentation, and monitoring, so the system can be operated without Foyla.

## Vulnerability management

- Automated dependency scanning on every build. Known vulnerabilities are triaged and fixed on defined internal timelines before release.
- Responsible disclosure: report a vulnerability to [legal@foyla.ai](mailto:legal@foyla.ai) with "Security" in the subject line and we will acknowledge within one business day.

## Business continuity

- For systems deployed in the client's environment, backups follow the client's existing policy, and we document what needs to be backed up and how to restore it.
- For systems we host, we use the cloud provider's managed backups with a documented restore procedure.
- Documented incident response process with severity levels, escalation, and client communication paths.

## Security roadmap

We are an early-stage company and say so plainly. The following controls are on our near-term roadmap rather than already certified. We will update this page as they ship.

- SOC 2 Type II: target audit period starting H2 2026.
- ISO 27001: scoping in parallel with SOC 2.
- Third-party penetration test of our internal systems: planned for H2 2026.
- Documented restore drills for hosted systems: planned alongside our first hosted enterprise deployment.
- Subprocessor change notification subscription.

If any of these are a gating requirement for you, let us know. We can often commit to a timeline in the Software Development Agreement.

## Compliance

US state privacy laws (CCPA/CPRA, Colorado, Connecticut, Virginia, Utah) and GDPR/UK GDPR are addressed in our Privacy Policy and DPA. SOC 2 and ISO are on the roadmap above.

## Contact

Security questions and vulnerability reports: [legal@foyla.ai](mailto:legal@foyla.ai)

Source: https://foyla.ai/legal/security/