Security signals your team can explain in one meeting.
The AILEO platform summary already includes the controls enterprise buyers usually ask about first: consent before optional AI processing, DLP/PII masking, short-lived widget tokens, encrypted transport, audit trails, retention windows, and clear provider-risk disclosure.
- Optional AI processing is designed to check consent before sending user data into live widget and LLM flows.
- DLP middleware can redact personal data before external model calls, reducing unnecessary exposure.
- Metadata, raw content, and embeddings are handled in separate layers to reduce blast radius.
- Retention windows are documented for chat history, payment records, and audit logs.
Retention policy
Chat history 90 days, audit logs 1 year, payment records 7 years.
PDPA rights
Access, erasure, rectification, objection, portability, and consent withdrawal workflows.
Operational security
Rate limiting, API key rotation, JWT authentication, bcrypt hashing, and TLS encryption.
Provider transparency
Residual provider-retention risk is disclosed clearly instead of being hidden behind vague claims.
DLP before optional LLM calls
PII can be detected and masked before optional data moves to external AI providers, helping reduce leakage risk in practical business workflows.
DLP · PII masking
Short-lived access model
Widget sessions use ephemeral or scoped tokens, while JWT, bcrypt, and TLS support stronger access control around the platform.
JWT · bcrypt · TLS
Retention and audit visibility
Operational logs, chat history, and key events follow documented retention windows so teams can review incidents and answer procurement questions faster.
Audit log · retention
Segmented data architecture
Metadata, content, and embeddings are not treated as one monolithic store, which helps reduce blast radius and supports cleaner access boundaries.
Metadata · content · embeddings