Security & trust
What Sylo handles is the most trusted line in your business. Below: exactly what we do with that data, how we handle third-party processors, where we are on independent audits, and what we haven’t earned yet.
We're working toward SOC 2 readiness; a Type I report is targeted before public launch.
Type II requires an observation period; it starts once a Type I report lands.
We intend to commission an independent third-party test of auth, payments, tenant isolation, and webhook security before general availability.
Customer data is encrypted in transit (TLS 1.3) and at rest in our database. Voice recordings and transcripts inherit the same posture as the rest of your data.
Every row of data carries a tenant identifier. Row-level security in the database enforces that boundary on every read and write, not optionally at the application layer.
Any account can turn on multi-factor authentication, with recovery codes for a lost device. Wayhow staff reach tenant data only through a privileged internal credential, used only when you ask us to look into something.
Our monitoring captures errors, latencies, and call metadata, never the contents of customer conversations. LLM calls are logged metadata-only; prompts and completions are never sent to telemetry.
Sylo detects the caller's state from area code and applies the right disclosure script (one-party or two-party consent) for that jurisdiction. Disclosures are logged per call.
From your dashboard you can export everything Sylo holds for your business as a single file, or permanently delete your account and all of its data, no support ticket required.
We don’t have a SOC 2 Type II report yet. We don’t have HIPAA certification; Healthcare is a separately gated tier we haven’t activated. We don’t claim ISO 27001 or HITRUST. Anyone in this category is either being honest about a pre-launch posture or stretching. We’d rather miss a quarter than ship a claim we can’t back.
If you need any of the above contractually today, we’re not the right fit yet, and we’ll say so on the discovery call. Talk to us anyway; we’ll tell you when we’ll be ready.
Sylo relies on a small, vetted set of third-party processors to run the service: cloud infrastructure and database, telephony and messaging carriage, AI runtime and language models, payment processing, transactional email, and operational monitoring. Each is bound by a Data Processing Agreement, and international personal-data transfers are governed by Standard Contractual Clauses. We don’t publish an itemized vendor list; where a customer’s contract requires vendor disclosure, we provide it under NDA as part of that agreement. Tenants receive 30 days’ notice before any new category of subprocessor begins processing their data.
Data-processing terms are in our Data Processing Addendum; security questions to info@wayhow.ai.
Send it to info@wayhow.ai. We read everything and reply with what we know and what we don’t.