AYWA is provided and billed by RTLS TechLab, Société par Actions Simplifiée (SAS), registered in FR under number 942468596, FR39942468596. Registered office: 166-168 Avenue Georges Clemenceau, 92000 Nanterre, FR. Legal contact: team@aywa.ai.
1. Security model
AYWA applies defence in depth across the control plane, voice runtime and integrations. Exact safeguards depend on deployment mode, enabled providers and contractual responsibilities. This page describes the general approach and is not a certification or SLA.
2. Isolation and access controls
Application resources are scoped by tenant and permissions by user and role. Sensitive operations require an authenticated session and server-side checks. Isolation must be complemented by correct customer configuration of members, roles, keys and integrations.
3. Communications and secrets
Public interfaces use encrypted connections when crossing external networks. Passwords are handled by the authentication service. Retrievable secrets required by providers and integrations are protected according to their use; they must not be confused with irreversibly hashed passwords.
4. Voice-data boundary
Calls, audio, transcripts, recordings, tool payloads and provider secrets are processed in the runtime environment and providers selected for the service. The AYWA control plane retains data needed for accounts, licensing, billing and instance status. The exact boundary depends on deployment and must be validated before production.
5. Logging and operational protection
Technical logs, rate controls, input validation and recovery mechanisms help detect and limit anomalies. Their coverage and retention depend on the component and plan. Sensitive information must not deliberately be placed in logs.
6. Retention, backup and deletion
Call-artefact retention depends on tenant settings, storage architecture and applicable duties. Backups and recovery objectives are defined per component and, for guaranteed commitments, by contract. Deletion may remain deferred in backups during their normal lifecycle.
7. Incident handling
Confirmed incidents are assessed, contained, analysed and communicated according to impact, agreement and law. Guaranteed response times, on-call coverage and availability objectives exist only when expressly included in the subscribed offer.
8. Reporting
To responsibly report a vulnerability or incident, email team@aywa.ai with only the necessary details. Do not test against third-party data, disrupt the service or publicly expose a secret or unremediated vulnerability.
Protecting access to customer records during calls
When an agent looks up a record during a call, the voice engine can refer to it using a temporary token in place of the record’s internal ID. This helps the agent follow the customer’s request while reducing exposure of the references used to access your records.
For access protected this way, tokens are encrypted, time-limited and tied to the call. The server checks the token and access permissions before providing access to the record. An expired token, or one used in a different call, is rejected.
Business information needed for the conversation remains subject to the agent’s configured permissions. Protecting record references complements the processing and retention measures described on this page; it does not anonymise the content of a conversation.