Request a scoping call

Privacy Policy

Last updated: October 18, 2026

1. Introduction

Ayliea ("we", "our", "us") operates the Ayliea marketing website at ayliea.com and the customer-facing Ayliea Assess web application, and provides independent security assessment and consulting services (collectively, the "Service"). References to the "App" below include Assess on the web and the native mobile application, which is currently in maintenance mode. Native-device storage and push notification disclosures apply only when you use the native application. App feature disclosures apply when you use those features; consulting evidence handling is also governed by the applicable engagement documents. This Privacy Policy explains what information we collect, how we use it, how we protect it, and how you can exercise applicable privacy rights.

2. Information We Collect

2.1 Account & Authentication Data

When you create an account in the App, we collect your email address and a password. Authentication is managed by Supabase Auth. Session tokens are stored securely on your device using encrypted native storage (expo-secure-store on iOS/Android) or secure cookies on web. We may also offer sign-in via Google or Apple; if you use these providers, we receive your name and email address from them but never your password.

  • TOTP factor enrollment status and associated metadata (stored by Supabase Auth)
  • Hashed backup recovery codes (stored in our database; plaintext codes are shown once during generation and not retained)

2.2 Assessment Data

When you complete security assessments in the App, we collect:

  • Your answers to assessment questions across supported compliance frameworks (e.g., CIS Controls v8, NIST 800-53, NIST CSF 2.0, HIPAA, ISO 27001, SOC 2, PCI DSS, AI Security)
  • Optional evidence notes you provide for individual questions
  • Computed category scores and overall assessment scores
  • Historical assessment scores over time
  • Composite posture scores across multiple frameworks and organization-configured framework weights
  • Recommendation status tracking (not started, in progress, completed) and completion dates
  • Recommendation feedback ratings (helpful / not helpful) with optional text comments, used to improve recommendation quality
  • Text chunks and vector embeddings derived from assessment responses, connected-tool evidence, and extracted evidence text for retrieval and AI-assisted features (see Section 5)

2.3 File Uploads

You may upload evidence attachments to support your assessment answers. Accepted file types are PDF, PNG, JPEG, TXT, and CSV, with a maximum size of 5 MB per file. Uploaded files are initially placed in a quarantine storage bucket, scanned for malware (see Section 5), and then promoted to an evidence storage bucket if they pass scanning. Files are accessible via time-limited signed URLs.

2.4 Organization Data

When you join an organization, we collect the organization name, industry, and size. Organization owners manage members via invite codes and collaborator links. Members within an organization can view shared assessments and recommendations scoped to that organization. Organization owners may also upload a logo image and set a brand color for customized PDF report generation.

2.5 Scoping Inquiry & Contact Data

When you submit an inquiry through ayliea.com/contact, we collect your work email address and any name, company, timeline, and message you provide, along with your follow-up preference. The form also includes a hidden "Company website" anti-spam field; submissions with that field completed are discarded. We use Cloudflare Turnstile to verify submissions (see Section 5). Please do not submit PHI, credentials, regulated records, or sensitive assessment evidence through initial contact.

Accepted inquiry details are emailed to Ayliea through Resend. Our CRM, Asana, receives your submitted contact details, company, timeline, message, inquiry type, source, campaign attribution, and follow-up preference in a private project so we can manage the request. Partner inquiries also include the firm and qualifying information submitted through that form. If you select the follow-up option, we may also add your email address to a Resend audience for inquiry follow-up communications.

2.6 Pre-engagement Intake and Consulting Data

If you complete Ayliea's client intake questionnaire, we collect the contact details you provide and high-level scoping information, which may include your organization's AI system or workload, technology and service providers, data categories, applicable frameworks or requirements, evidence readiness, participating roles, and timing. We use this information to evaluate the request, prepare for a scoping discussion, and follow up about the requested services. The questionnaire asks you not to submit PHI, passwords, API keys, access tokens, private keys, secrets, or raw assessment evidence. Please keep responses to business and scoping information.

To manage follow-up and deletion deadlines, we also keep a limited operational record in a private Asana project. It contains the Formbricks response ID and inquiry dates and status, but not survey answers or contact details.

Information submitted before an engagement agreement or NDA is executed is not covered by those later agreements. Do not submit confidential or restricted information through the intake form. During a consulting engagement, additional information about AI systems, data flows, security controls, and compliance posture may be collected as described in the signed engagement documents.

2.7 Technical & Analytics Data

We automatically collect limited technical data necessary to operate and improve the Service:

  • Device type, operating system, and browser version
  • Pages visited, session duration, and referral source (website)
  • Approximate geographic location (city-level, via Google Analytics on the website)
  • Crash reports and error logs (sanitized to exclude personal data)

On the website, we use Google Analytics 4. Google Analytics uses cookies to distinguish visitors (see our Cookie Policy for details).

We also use Vercel Analytics and Vercel Speed Insightson all pages of the website. These services are provided by Vercel Inc. and collect website usage and performance metrics, such as page or route, referrer, browser, device information, and Web Vitals. They operate independently of the analytics-cookie preference. Vercel describes these services as cookieless and privacy-focused; this does not mean that no technical request information is processed by Vercel. See Vercel's Privacy Policy for details.

On the website and in the App, we use PostHogfor product analytics. PostHog collects usage events (e.g., page views, assessment completion, feature usage, quick check retakes), device information, and session data. PostHog assigns a pseudonymous identifier to your device. On the website, PostHog is activated only after you have accepted analytics cookies via the consent banner; session recordings, where enabled, mask all text inputs. We do not enable PostHog's personal data enrichment features.

2.8 Push Notification Data

If you use the native mobile application and grant permission, we may send push notifications via Expo Notifications to remind you about re-assessment schedules. We store your device push token to deliver these notifications. You can disable push notifications at any time through your device settings.

2.9 Public Resource Downloads

Ayliea's public guides and templates can be viewed or downloaded without providing your name, email address, or company information. Some resource pages offer a separate, optional newsletter signup. If you choose to subscribe, the information collected and how it is used are described in Section 2.10.

2.10 Newsletter Subscription Data

When you subscribe to our newsletter, we collect your email address. Your email is stored with our email service provider, Resend, as a contact in our subscriber list. We use this email address to send you a one-time welcome email and periodic newsletter content about AI security insights, compliance updates, and risk management guidance.

Unsubscribe and preferences links included in each email contain a cryptographically signed token that embeds your email address. These tokens expire after 90 days and cannot be forged or reused. You can unsubscribe at any time using the link in every email, through the email preferences page, or by contacting us at privacy@ayliea.com.

2.11 Data We Do Not Collect

We do not collect:

  • Precise location data (GPS)
  • Contact lists or address books
  • Browsing history outside the Service
  • Financial information (payment processing is handled by third-party processors; optional financial impact estimates for AI incidents are stored but are not payment data)
  • Biometric data

2.12 AI Governance Data

When you use AI Governance features included in your Order, we collect additional data per feature:

  • AI System Registry — when you register AI systems, we collect system metadata including name, vendor, vendor URL, deployment type, status, department, data classification, and business criticality. For each registered system, you may document use cases (including whether the system processes PII or PHI, affects individuals, and the decision domain) and data flows (including cross-border transfer destinations and encryption status).
  • Risk Classification — when you classify AI system risk, we store classification results including EU AI Act risk tiers, NIST AI RMF impact and likelihood assessments, risk factors, governance requirements, and any override reasons you provide. Classification history is retained as an append-only audit trail.
  • Vendor Risk Assessments— when you create a vendor assessment, we collect the vendor contact's name and email address to send the assessment invitation. Vendors complete questionnaires through a public portal (accessible via a time-limited tokenized URL without authentication) and may provide answers, evidence URLs, and notes. We score vendor responses and store the results.
  • Incident Tracking — when you report AI incidents, we collect incident details including descriptions, severity, category, root cause analysis, contributing factors, remediation steps, and preventive measures. We also collect optional financial impact estimates and regulatory notification tracking information (regulatory bodies, deadlines, and notification sent status). Incident timelines record all status changes, assignments, and comments as an audit trail.
  • Regulatory Compliance Tracking— when you use the regulatory timeline, we store your organization's operating jurisdictions and compliance status for tracked regulatory milestones, including owner assignments and target completion dates.

3. How We Use Your Information

  • Provide the App — authenticate your account, store and display your assessment answers and scores, generate recommendations, and deliver evidence reports
  • AI-assisted retrieval and recommendations— create searchable text chunks and embeddings from assessment responses and evidence using OpenAI, and send assessment results, organization context, and selected evidence excerpts to Anthropic's Claude API to generate recommendations (see Section 5)
  • Scan uploaded files — check file hashes and, when necessary, file contents against malware databases to protect the Service and its users (see Section 5)
  • Organization collaboration — share assessments, recommendations, and scores with members of your organization
  • Send notifications — deliver push notifications for re-assessment reminders (if you have opted in)
  • Respond to inquiries — reply to scoping and contact inquiries, and arrange requested discussions
  • Deliver consulting services — conduct assessments, produce deliverables, and provide advisory support as defined in your engagement agreement
  • Service communications — send essential notifications about your account, engagement, deliverables, and service updates
  • Newsletter communications — send AI security insights and company updates to subscribers who have opted in
  • Pre-engagement scoping — review intake responses to understand a requested assessment, prepare for a scoping discussion, and follow up about the request
  • AI Governance — register and manage AI systems, classify risk, track compliance, and generate governance reports
  • Vendor risk assessments — send questionnaires to your AI vendors, collect their responses, and score their security posture
  • Incident management — log, investigate, and resolve AI incidents; generate preventive recommendations
  • Regulatory compliance — track applicable AI regulations, monitor compliance deadlines, and manage compliance status
  • AI risk analysis— send AI system metadata to Anthropic's Claude API to generate risk classification narratives, where this feature is included in your Order (see Section 5)
  • Vendor communications — send assessment invitations and reminder emails to vendor contacts via Resend
  • Improve the Service — analyze aggregate, anonymized usage patterns on our website and App to improve content and user experience
  • Record consent — when you accept, reject, or customize cookie preferences, we log the action type, your selected preferences, consent version, and timestamp server-side. This fulfills our obligation under GDPR Article 7 to demonstrate that consent was given. These logs do not contain your IP address or any other personally identifiable information.

4. Data Protection

  • Encryption in transit — all data is transmitted over HTTPS/TLS
  • Encrypted credential storage— on native devices, authentication tokens are stored using expo-secure-store, which uses the device's hardware-backed keychain (iOS) or encrypted SharedPreferences (Android)
  • Row-level security— database access is enforced through Supabase Row Level Security policies, ensuring users can only access their own data (or their organization's data when they are a member of a multi-seat organization)
  • Envelope encryption for sensitive PII — name parts on user profiles, evidence file metadata, and integration credentials are encrypted at the application layer using per-organization Data Encryption Keys (DEKs). DEKs are themselves wrapped by a Master Encryption Key (MEK) held only in the application runtime environment, so a database-only compromise does not yield plaintext
  • File quarantine — uploaded files are held in a quarantine bucket and scanned for malware before being made accessible. Infected files are deleted automatically.
  • Signed URLs — evidence files are accessible only via time-limited signed URLs, not publicly accessible links
  • Non-disclosure agreements— all consulting engagements are conducted under strict NDAs that protect your organization's data
  • Access controls — restrict engagement data access to authorized personnel and service providers with a delivery need, subject to the applicable engagement terms
  • Sanitized logging — application logging controls are designed to redact credentials and personal data from error events; technical request metadata may still be processed as described in this policy

5. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

We share data only in these limited circumstances:

  • Infrastructure & database provider— Supabase hosts the App's database, authentication, file storage, and serverless functions. Your account data, assessment data, and uploaded files are processed and stored by Supabase under their data processing agreement. See Supabase's Privacy Policy
  • Application hosting & CDN — Vercel hosts the web application, runs serverless functions for API routes, and serves static content through its edge network. Vercel processes request metadata (IP address, user-agent, request URL) needed to route and deliver responses. See Vercel's Privacy Policy
  • Payment processor — if you pay an invoice or use an enabled checkout, Stripe processes billing and payment details. Payment card details are entered through processor-hosted forms; Ayliea may receive billing contact information, payment status, invoice records, and limited payment-method metadata. See Stripe's Privacy Policy
  • Error tracking — Sentry receives application error events from the App where error tracking is configured. We sanitize error payloads to strip personal data before transmission; user IDs are sent in pseudonymized form for issue correlation only. See Sentry's Privacy Policy
  • Rate limiting — Upstash provides a key-value store used to enforce API rate limits where Redis-backed rate limiting is configured. Website endpoints use client IP addresses as rate-limit keys; these identifiers are not hashed by the website rate limiter. For inquiry delivery deduplication, this store also keeps a keyed hash and delivery status for up to 24 hours; it does not store the inquiry contents for that purpose. See Upstash's Privacy Policy
  • AI embeddings and retrieval provider — OpenAI processes text supplied to its embeddings API to create vector embeddings for search and retrieval. The ingestion pipeline can process assessment questions and answers and scores, connected-tool evidence and structured signals, and text extracted from uploaded evidence attachments. Text chunks and embeddings are stored in Supabase. Ingestion may run through scheduled background jobs, separately from a recommendation request. OpenAI also processes retrieval-query text used to find relevant chunks. See OpenAI's Privacy Policy.
  • AI recommendation provider— Anthropic's Claude API processes assessment scores and category information, organization profile and environment details, and relevant remediation guidance to generate recommendations. Where matching retrieval content is available, selected text chunks from your organization's documents, assessment responses, connected-tool evidence, or extracted evidence attachments may also be included. This flow sends extracted text rather than the original uploaded file, but the text may contain information from that file. See Anthropic's Privacy Policy.
  • AI risk analysis provider— when you request AI-assisted risk analysis for a registered AI system, where this feature is included in your Order, the system's metadata, use cases, and data flow descriptions are sent to Anthropic's Claude API to generate a risk classification narrative. This includes the system's PII/PHI involvement flags and cross-border data flow destinations. Free-text metadata and descriptions may contain personal or confidential information that you enter. Do not include patient records, credentials, or other restricted information in these fields. See Anthropic's Privacy Policy
  • AI questionnaire autofill (planned) — AI Questionnaire Autofill is not yet generally available. This planned feature is separate from the existing embeddings, recommendations, and risk analysis described above. We will update this policy with its data processing and providers before it becomes generally available.
  • Customer-relationship management (CRM) — when you submit a contact, scoping, or partner inquiry, Asana receives the submitted contact details and inquiry contents described in Section 2.5 to manage follow-up in a private CRM project. See Asana's Privacy Policy.
  • Form abuse protection — Cloudflare Turnstile processes browser and challenge information to verify contact-form submissions. Our server sends the verification token to Cloudflare; it does not include inquiry fields or explicitly forward the client IP address in that verification request. Cloudflare may process technical request information when its challenge loads in your browser. See Cloudflare's Privacy Policy.
  • Malware scanning provider— when you upload a file, the file's SHA-256 hash is sent to VirusTotal (owned by Google/Alphabet) to check against known malware signatures. If the hash is not found in VirusTotal's database, the full file may be submitted for analysis. VirusTotal retains submitted files and makes scan results available to its community of security researchers. See VirusTotal's Privacy Policy
  • Analytics provider (website & App) — PostHog processes pseudonymized usage events from the website and the App (page views, feature usage, assessment completion events, device information). On the website, PostHog is activated only after you accept analytics cookies; session data is masked for PII. We do not send personal data or assessment content to PostHog. See PostHog's Privacy Policy
  • Website analytics provider — Google processes anonymized website usage data through Google Analytics 4. We do not enable advertising features, user-ID tracking, or data sharing with other Google products. See Google's Privacy Policy
  • Survey and intake provider— Formbricks GmbH provides the hosted Formbricks service used for Ayliea's client intake questionnaire. It processes responses on Ayliea's behalf, including the contact and high-level scoping information described in Section 2.6, and technical request metadata needed to deliver and protect the service. Formbricks states that survey data is encrypted and stored in Germany. Its published privacy notice describes subprocessors and their processing locations, which may include global technical-service processing. See Formbricks' Privacy Policy, its Data Processing Agreement, and its respondent and retention information.
  • Inquiry tracking provider— Asana provides the work-management service we use for a private register of intake response IDs and inquiry status and date metadata, including closure, deletion deadline, and deletion completion. We do not put survey answers or respondent contact details in this register. See Asana's Privacy Statement.
  • Email service provider — Resend processes contact inquiry details, inquiry follow-up audience email addresses, newsletter subscriber data, and vendor assessment invitation emails (including vendor contact names and email addresses) to deliver communications on our behalf. See Resend's Privacy Policy
  • Organization members— every account belongs to an organization. Solo accounts are scoped to a hidden “Personal” workspace with one seat that is visible only to you. Multi-seat organizations share assessment data, recommendations, and scores among members. Organization owners control membership via invite codes and collaborator links.
  • Vendor respondents— when you send a vendor assessment, the vendor's designated contact receives a tokenized URL to complete the questionnaire. The vendor can see your organization's name and logo but cannot access any other data in your account. Vendor responses are visible to members of your organization.
  • Customer webhook endpoints — if your organization configures webhooks (advanced features available per-org), incident event data (incident ID, title, severity, category, and status changes) is sent to your specified HTTPS endpoints. You control the destination URLs and are responsible for the security of your webhook endpoints.
  • Legal requirements — if required by law, court order, or governmental authority

Sending content to an AI provider for embeddings or inference is separate from model training. OpenAI and Anthropic describe their commercial API services as not using customer inputs and outputs for model training by default. Provider processing and retention depend on the applicable API terms, account configuration, and any separate agreement; this policy does not promise zero provider retention. See OpenAI's API data controls and Anthropic's commercial data-use information.

6. Data Retention

Account data and assessment data are retained for as long as your account is active. You may delete your account and all associated data at any time through the App or by contacting us. Uploaded evidence files are retained for as long as the associated assessment exists. Files that fail malware scanning are deleted immediately.

Contact, partner, and sales inquiries are managed in a private Asana CRM project while active. An inquiry closes on an explicit decline, conversion to a signed engagement, or 30 days after our final unanswered follow-up. For inquiries that do not become engagements, we delete the inquiry task and notification emails within 90 days after closure, unless a documented legal hold requires longer retention. For converted inquiries, we transfer only information needed for the engagement and delete the original inquiry copies when no longer needed. The separate Formbricks intake schedule is described below. Formbricks intake responses remain in Formbricks while an inquiry is active. We close an intake inquiry when you explicitly decline, when it converts to a signed engagement, or, if we receive no reply, 30 calendar days after our final follow-up. If an inquiry does not become an engagement, we delete its Formbricks response within 90 days after it closes. If it becomes an engagement, information needed for that work is handled under the applicable signed engagement documents, and we delete the original intake response when it is no longer needed for the engagement. We keep only limited response-ID and status/date metadata in a private Asana register to manage follow-up and verify deletion; the register does not contain survey answers or contact details. We retain deletion-log metadata for 12 months after the Formbricks response is deleted, then remove the response ID and other inquiry-specific log metadata, unless a legal requirement or documented legal hold requires longer retention. You may request access, correction, or deletion by contacting us. Formbricks states that response data deleted by the researcher are permanently removed from backups within 90 days.

AI governance data — including registered AI systems, risk classifications, vendor assessments, incident records, and regulatory compliance tracking — is retained for as long as your organization's account is active. Risk classification history is maintained as an append-only audit trail. Vendor assessment records persist after token expiry. Incident records cannot be deleted by end users (only closed with a note); administrators may permanently delete incident records. All governance data is cascade-deleted when your organization is deleted.

7. Your Rights

You have the right to:

  • Access — request a copy of personal data we hold about you
  • Correction — request correction of inaccurate data
  • Deletion — request deletion of your personal data
  • Portability — receive your data in a structured, machine-readable format

8. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete it.

9. International Data Transfers

Ayliea and its service providers may process information in the United States and other countries. Formbricks states that its survey data is encrypted and stored in Germany. Formbricks' published subprocessor information also describes global processing of certain technical request data. Other providers' processing locations are described in their linked privacy materials and applicable agreements. Asana states that some information is stored in the United States and that information may also be transferred to regions where its subprocessors and affiliates are located; see its linked Privacy Statement.

AI-assisted retrieval, recommendations, and risk analysis transmit the content described in Section 5 to OpenAI and Anthropic. Those providers may process information in the United States and other locations described in their terms and applicable service configurations. Resend processes inquiry, subscriber, and vendor invitation information to deliver communications as described above.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any updated policy on this page and change the "Last updated" date. Please review this page periodically for changes.

11. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at privacy@ayliea.com.