Security

Last updated: [date TO BE CONFIRMED]

Draft document — to be reviewed by a lawyer.

Here is how WYRLO protects the data your RAG sends it. This page describes the service as it works today; points still to be confirmed are marked.

Hosted in the European Union

Database and functions: Supabase, eu-west-3 region (Paris).
Web application: Vercel, functions in the cdg1 region (Paris).

Your documents are never stored

For each question, WYRLO receives the question, excerpts of the passages retrieved by your RAG, and the answer. Your documents stay with you: we never copy or index them.

Masked traces, limited retention

Traces are masked before storage [masked data and method TO BE CONFIRMED].

They are kept for 30 days by default, then deleted. Your organisation can choose 30, 90 or 180 days.

Encryption

Data is encrypted [scope and algorithms TO BE CONFIRMED].

in transit: [TO BE CONFIRMED];
at rest: [TO BE CONFIRMED].

Strict isolation between organisations

Each organisation only sees its own data. Isolation is enforced by access rules at database level, not just in the application code: a query can only read rows that belong to the signed-in person’s organisation.

API keys

An API key is shown only once, when it is created.
Only its hashed fingerprint is stored: the key itself cannot be read back, not even by WYRLO.
[Key revocation and rotation: TO BE CONFIRMED]

Activity log

Sensitive actions, such as creating an API key or changing a setting, are recorded in an activity log with who did them and when.

[Logged actions, retention period and access: TO BE CONFIRMED]

Website and browser

The website uses no non-essential cookies and no tracking tools. It enforces HTTPS, refuses to be displayed inside third-party pages and limits the information passed on to other sites.

Certifications and audits

[Security certifications and audits: TO BE CONFIRMED]

Report a vulnerability

Think you have found a security flaw? Write to [address TO BE CONFIRMED] with a description of the issue and the steps to reproduce it.

Please do not make the flaw public before it is fixed. [Response time and disclosure policy: TO BE CONFIRMED]