---
title: "Security & Data"
url: https://docs.aila.fyi/security
source: https://docs.aila.fyi/llms.txt
---

# Security & Data

Customer data is handled in private, encrypted, access-controlled workflows and used only to provide Aila's services. Aila does not use customer data to train public models.

For the full overview, see [withaila.com/security](https://www.withaila.com/security) and the [Aila Trust Center](https://app.vanta.com/withaila.com/trust/fr2cvd2ozs1pw5wxvyqlki).

---

## SOC 2

Aila's **SOC 2 Type 2 audit is in progress** with [Sentry Assurance](https://www.sentryassurance.com/). Controls are monitored continuously with Vanta. See current posture in the [Trust Center](https://app.vanta.com/withaila.com/trust/fr2cvd2ozs1pw5wxvyqlki).

SOC 2 is an independent audit standard from the AICPA. A Type 2 report tests whether controls actually worked over a period of months, not just at one point in time.

---

## How we protect your data

| Area | What Aila does |
| :--- | :--- |
| **Private AI processing** | AI processing runs through business API providers, never consumer chat products. Our AI providers operate under zero data retention for loan data. |
| **Data protection** | Customer data is encrypted in transit and at rest. Records are isolated by organization. |
| **Access control** | Role-based permissions limit account access (see [Team and billing](https://docs.aila.fyi/settings/team-subscription)). Stored files are opened only through signed links that expire. |
| **Deletion & retention** | Aila retains customer data to run the service and permanently deletes it on verified request, subject to legal and compliance retention. Custom retention rules are available on request. |

## What Aila does not do

- Sell your data
- Use your data to train general-purpose AI models
- Let our AI providers keep your data
- Share your records with other Aila customers

A sub-processor list is available on request.

---

## Product-level controls

- **Approvals:** Agent writes to your LOS and borrower emails wait for approval, and approved changes can be undone. See [Approvals and undo](https://docs.aila.fyi/agents#approvals-and-undo).
- **Sensitive fields:** MISMO 3.4 exports contain the borrower's full Social Security number, because the LOS needs it. Send them only to people and systems that should see it.
- **API keys:** Created only by Owners and Admins, with the permissions you choose, an optional expiration, and deletion at any time. See [Authentication](https://docs.aila.fyi/api-reference/authentication).

---

## Contact

- Security questions: [support@aila.fyi](mailto:support@aila.fyi)
- Privacy requests: [privacy@aila.fyi](mailto:privacy@aila.fyi)
- [Privacy Policy](https://www.withaila.com/privacy) · [Terms of Service](https://www.withaila.com/tos)