Security & trust
What Sylo handles is the most trusted line in your business. Below: exactly what we do with that data, how we handle third-party processors, where we are on independent audits, and what we haven’t earned yet.
Our full internal control set is implemented and monitored with automated evidence collection; an independent Type I audit is the next step.
Type II requires an observation period; it starts once a Type I report lands.
We intend to commission an independent third-party test of auth, payments, tenant isolation, and webhook security before general availability.
Customer data is encrypted in transit (TLS 1.3) and at rest in our database. Voice recordings and transcripts inherit the same posture as the rest of your data.
Every row of data carries a tenant identifier. Row-level security in the database enforces that boundary on every read and write, not optionally at the application layer.
Every Wayhow staff account must enroll two-factor authentication before our admin tools open at all, and each staff member sees only the sections their role grants. Your accounts can turn on multi-factor with recovery codes, and enterprise teams can sign in through their own identity provider with SAML single sign-on.
Our monitoring captures errors, latencies, and call metadata, never the contents of customer conversations. Administrative actions land in an audit log the database itself refuses to edit or delete, and account owners have their own activity log showing which of their team members changed what.
The phone line is the product, so availability is engineered, not hoped for. Our voice stack detects a failing upstream provider, switches itself to a healthy one, and switches back automatically once the outage clears; a paging system wakes a human either way.
Sylo detects the caller's state from area code and applies the right disclosure script (one-party or two-party consent) for that jurisdiction. Disclosures are logged per call.
From your dashboard you can export everything Sylo holds for your business as a single file, or permanently delete your account and all of its data, no support ticket required.
We don’t have a SOC 2 Type II report yet. We don’t have HIPAA certification; Healthcare is a separately gated tier we haven’t activated. We don’t claim ISO 27001 or HITRUST. Anyone in this category is either being honest about a pre-launch posture or stretching. We’d rather miss a quarter than ship a claim we can’t back.
If you need any of the above contractually today, we’re not the right fit yet, and we’ll say so on the discovery call. Talk to us anyway; we’ll tell you when we’ll be ready.
Sylo relies on a small, vetted set of third-party processors to run the service: cloud infrastructure and database, telephony and messaging carriage, AI runtime and language models, payment processing, transactional email, and operational monitoring. Each is bound by a Data Processing Agreement, and international personal-data transfers are governed by Standard Contractual Clauses. We don’t publish an itemized vendor list; where a customer’s contract requires vendor disclosure, we provide it under NDA as part of that agreement. Tenants receive 30 days’ notice before any new category of subprocessor begins processing their data.
Data-processing terms are in our Data Processing Addendum; security questions to info@wayhow.ai.
Send it to info@wayhow.ai. We read everything and reply with what we know and what we don’t.