Security at YourLio

Security is part of how we operate YourLio, from the infrastructure behind the platform to how your team accesses customer information.

SOC 2 Type II

Audit in progress

EU and UK data protection

Processing terms and transfer safeguards

Regional privacy rights

Requests handled under applicable law

For a security assessment, data processing agreement, or questions about these controls, contact our team. Our Privacy policy explains how we handle personal information and requests.

YourLio encrypts data in transit and at rest. Credentials and integration tokens are protected separately from public application code.

• In transit: TLS 1.2 or later protects API calls, webhook payloads, and chat sessions.
• At rest: AES-256 encryption protects stored data.
• Credentials: Shopify API credentials and third-party tokens are stored in encrypted vaults.
• Key management: Encryption keys are rotated on a regular schedule.

Access follows the principle of least privilege. People and integrations receive the permissions needed for their work.

• Role-based access controls for internal systems.
• Multi-factor authentication for team members.
• Logical separation of client data between accounts.
• Logged and audited access to production systems.
• Scoped OAuth tokens for integrations such as Shopify and Meta.

The platform uses AWS and Google Cloud (GCP) for cloud infrastructure and hosting, with multi-region redundancy and capacity that scales with demand.

• Auto-scaling for traffic increases during sales and promotions.
• Automated backups with point-in-time recovery.
• A 99.9% production uptime SLA, with scope and exclusions set out in the agreed service-level terms.

See service levels and exclusions for how third-party platforms and other dependencies affect availability.

Brand clients retain ownership of their customer data, conversation transcripts, and outputs generated using that data. YourLio acts as a processor to deliver the agreed services.

• We do not sell, rent, or trade personal data.
• Client data is not used to train models for other clients or third parties.
• After termination, client data is returned or securely destroyed within 30 days of a written request, subject to the retention provisions in our Privacy policy.

Read the retention and deletion policy or learn how to exercise your privacy rights.

YourLio agents use each brand’s product catalog, policies, and knowledge base to answer shoppers. Brand-specific configuration keeps responses relevant to that store.

• Separate brand context and configuration prevent customer information from being mixed across clients.
• Human handoff supports sensitive topics, edge cases, and low-confidence responses.
• Brand owners can review, override, and refine AI behavior in the dashboard.

We use service providers to deliver the platform. Their role depends on the services and integrations you use.

Platform services

Sub-processors handling client data are bound by confidentiality and security obligations. We notify clients before adding new sub-processors that handle personal data.

YourLio is operated by HELIOAI AGENTIC SYSTEMS PRIVATE LIMITED in India. We support customers’ security and privacy reviews with information about the services they use, our responsibilities, and the applicable contractual safeguards.

• EU and EEA: EU Standard Contractual Clauses support relevant transfers of personal data outside the EEA, including to India.
• United Kingdom: UK transfer safeguards are in place for relevant restricted transfers.
• United States and other regions: Data handling and requests are assessed under the laws that apply to the client, individual, and processing involved.

Before onboarding, contact us with your security questionnaire or procurement requirements. We can discuss the relevant DPA, transfer safeguards, provider roles, access controls, retention requirements, and agreed service levels. Confirm any required processing location or data residency restriction in your agreement.

Our Privacy policy explains international transfers and rights by region, including how individuals can make requests and raise concerns.

We maintain a documented incident response process for detecting, containing, and resolving security events.

• 24/7 automated monitoring and alerting across production systems.
• Defined escalation paths and ownership based on incident severity.
• Notification to affected clients within 72 hours of a confirmed data breach, or sooner where applicable law requires.
• Post-incident reviews for significant events, with findings documented and addressed.

If you find a potential security issue, email our team with the affected page or feature, the steps to reproduce it, and the potential impact.

• Use only accounts and data you own or have permission to test.
• Do not access other customers’ data, disrupt services, or share the issue publicly before we can investigate.
• Do not include passwords, API keys, or customer data in your initial report.

We will review your report and coordinate the next steps with you.