Security controls built for business trust.

Core security controls

The current platform summary includes layered controls across authentication, encryption, data filtering, rate limiting, retention, and auditability.

• JWT authentication with strong secret requirements.
• Password hashing with bcrypt.
• TLS/SSL for data in transit.
• Audit logging retained for one year.
• Automatic API key rotation rules and provider cooldown handling.
• Ephemeral or short-lived tokens for widget sessions.

DLP, PII, and AI data flow

Before optional AI processing, the service is designed to check consent and apply DLP/PII handling so external providers receive less sensitive context.

• DLP middleware can detect and redact personal data before LLM calls.
• Chunking, truncation, deduplication, and caching reduce unnecessary payload size.
• Rate limiting helps control abuse and excessive requests.
• Provider usage still requires reviewing each vendor retention policy and enterprise agreement.

Data segmentation and retention

AILEO separates metadata, content, and embeddings to reduce blast radius and make storage governance clearer.

• Metadata may be stored separately from raw content.
• Embeddings live in their own retrieval layer.
• Retention windows are defined for chat history, payment records, and audit logs.
• This segmented design supports better access control per storage layer.

Important risk note

Residual risk still exists when data is processed by external AI providers. The platform summary explicitly notes that provider-specific retention and privacy terms must be reviewed before sensitive production usage.

• Low-to-moderate leakage risk depends on DLP operating correctly.
• A fail-open DLP design is more available but less privacy-safe for sensitive data.
• A fail-closed or hybrid model is recommended for higher-sensitivity deployments.

Operational policy snapshot