Security & Compliance

Security at every layer across Agents, Parties, and Bridges. Organization-level data isolation across the whole platform. Enterprise-grade safeguards built into the architecture from day one.

Built on infrastructure you can trust

AYBIZA runs on the same cloud, payment, and AI infrastructure trusted by Fortune 500 companies. We don't try to be the exception — we build on the standard.

Built on AWS

Our entire platform runs on Amazon Web Services in us-east-1. Multi-AZ deployment by default — built for reliability and data residency requirements.

Payments by Stripe

All billing and subscriptions processed by Stripe — a PCI Level 1 Service Provider. AYBIZA never stores, processes, or transmits raw cardholder data directly. Stripe Tax and Adaptive Pricing apply at checkout for 150+ currencies.

Modern AI, multi-model

AYBIZA orchestrates across the major LLM and voice providers. Bring your own API keys (BYOK) to keep your existing enterprise agreements, compliance sign-offs, and volume discounts — with a 50-70% discount on AYBIZA credits.

Infrastructure security

Encryption

TLS 1.3 for all data in transit. AES-256 encryption at rest. Per-organization encryption keys derived from AWS KMS. End-to-end encryption available for sensitive communications.

Access Control

Role-based permissions, multi-factor authentication (TOTP), session management with short-lived JWTs, IP allowlisting, and scoped API keys with rotation and revocation.

Audit Logging

Comprehensive audit trails for every system access, data modification, and administrative action — for humans and AI agents alike. Tamper-evident log storage with retention aligned to regulated-industry expectations.

Database security

Data Isolation

Every organization's data is isolated at the database level. Cross-tenant access is prevented by design. Your data is never accessible to other customers.

Rate Limiting

API rate limits scale with your plan. Fail-secure defaults protect the platform under load. Enterprise customers get custom limits.

Backup & Recovery

Automated daily backups with point-in-time recovery. Multi-AZ deployment for high availability. Your data is protected against infrastructure failures.

Compliance

HIPAA

Architecture designed to support HIPAA requirements on qualifying Enterprise pipeline configurations. Enterprise plans include Business Associate Agreements (BAA) and encrypted PHI handling. Contact sales for details.

SOC 2

Architecture designed following SOC 2 controls for security, availability, and confidentiality. Third-party assessment planned. Contact sales for current compliance status.

GDPR

GDPR-ready infrastructure. Data Processing Agreement (DPA) available on request. Right to erasure, data portability, and privacy-by-design architecture. Built with GDPR principles in mind.

PCI

Payments processed by Stripe (PCI Level 1 Service Provider). AYBIZA never stores, processes, or transmits cardholder data directly.

ISO 27001

Architecture aligned with the ISO 27001 framework. Formal assessment planned alongside SOC 2.

Data Residency

We operate on AWS infrastructure in the US (us-east-1). Enterprise customers can discuss regional deployment options for data residency requirements.

Application security

Telecom-Grade Infrastructure

Built on technology that powers telephone switches and messaging systems. Process isolation, fault-tolerance, and automatic recovery are part of the architecture.

Security Headers

HSTS with preload, Content Security Policy with nonce-based script execution, X-Frame-Options DENY, and strict referrer policies on every response.

Responsible disclosure

We value the security research community. If you discover a vulnerability, report it to [email protected]. We acknowledge receipt within 24 hours and provide updates throughout the resolution process.