> For the complete documentation index, see [llms.txt](https://docs.usepylon.com/pylon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.usepylon.com/pylon-docs/security/security-overview.md). # Security Overview Learn more about Pylon's Security ### Enterprise-Grade Security Pylon is built for companies that take security seriously. We serve customers across financial services, healthcare, and enterprise software—industries where data protection isn't optional. ### Compliance & Certifications We maintain the certifications your security team expects. Pylon holds active SOC 2 Type II and ISO 27001:2022 certifications, with annual audits to ensure ongoing compliance. Both our US and EU deployments are in scope. We're also GDPR compliant, with HIPAA BAAs and Data Processing Agreements available upon request. All compliance documentation, including our SOC 2 report and ISO 27001 certificate, is available at [trust.usepylon.com](http://trust.usepylon.com). ### AI Security Pylon uses AI to power intelligent support features. We've built our AI infrastructure with enterprise security requirements in mind. We maintain zero data retention agreements with all AI providers, meaning your data is never stored by third-party AI vendors and is never used to train AI models. Customer data is isolated at the request level and never commingled with other customers during AI processing. All AI API calls are encrypted using TLS 1.2+. AI inference and processing are performed in the same region where your data resides. For customers on our EU region, this means AI processing happens entirely within the EU. ### Infrastructure Pylon is hosted on AWS, leveraging AWS's SOC 2 and ISO 27001 certified environment. We operate two regions: the United States (us-west-2, Oregon) and the European Union (eu-central-1, Frankfurt). All data is encrypted using AES-256 at rest and TLS 1.2+ in transit. We perform daily encrypted backups, replicated within the same region boundary as the source data, and maintain network isolation through VPCs, network segmentation, and security groups. ### Enterprise Security Features Pylon gives your team the controls they need to meet your security and compliance requirements. For identity and access management, we support SSO via SAML 2.0 with providers like Okta, Azure AD, and Google Workspace. SCIM integration enables automated user provisioning and deprovisioning, and role-based access controls let you define granular permissions for your team. For audit and compliance, Pylon provides comprehensive audit logs covering user activity and data access. Activity logs can be exported via API for integration with your SIEM. Data retention is configurable within the platform, with support for auto-deletion policies and on-demand deletion when needed. Full data export is available for compliance and portability requirements. ### Security Practices We conduct annual third-party penetration tests and run continuous vulnerability scans with defined remediation SLAs. Access to all systems follows the principle of least privilege, with quarterly access reviews. Pylon support personnel access customer data only when actively working a support ticket. Access requires approval, and every access is logged. ### Availability We monitor service health around the clock. Check our current status and uptime history at [status.usepylon.com](http://status.usepylon.com). ### Vulnerability Disclosure We maintain an active vulnerability disclosure program. Security researchers can report vulnerabilities to . Visit for more details ### Subprocessors Pylon uses industry-standard third-party services for cloud infrastructure, AI processing, payment processing, and analytics. For a complete list of subprocessors, including the region each operates in, visit [usepylon.com/subprocessors](http://usepylon.com/subprocessors). ### Frequently Asked Questions **Where is my data stored?** In AWS, either in the United States (us-west-2, Oregon) or the European Union (eu-central-1, Frankfurt). Your instance is assigned to one region, and your data is stored and processed there—it does not move between regions. **Do you offer EU data residency?** Yes. Customers on our EU region have their data stored and processed entirely within AWS eu-central-1 (Frankfurt), including AI inference. Backups replicate only within the EU. **Is my data used to train AI models?** No. We have zero data retention agreements with all AI providers. Your data is never used to train or improve AI models. **How quickly can my data be deleted?** Upon request, we can delete all your data within 72 hours. Contact for deletion requests. **Do you support security questionnaires?** Yes. Our SOC 2 Type II report is available under NDA at [trust.usepylon.com](http://trust.usepylon.com), and we're happy to complete security questionnaires for prospective customers. ### Contact For security questions or to report a vulnerability, contact . For compliance documentation and our SOC 2 report, visit [trust.usepylon.com](http://trust.usepylon.com). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.usepylon.com/pylon-docs/security/security-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.