Security
Built so a human is always in control.
Sioona observes and suggests. It never acts on its own, and it never contacts your customers.
Principles
Human in the loop
Every signal is reviewed by a person before it’s acted on. Correct, Incorrect and Mark Acted are human decisions only.
Tenant isolation
Each pilot is set up as a single tenant, so your conversations, signals and reviews stay in your own workspace.
No outbound messaging
In Shadow Mode, Sioona never sends anything to your customers. Suggested actions are display-only.
Data Handling
Only the chat text, and only what’s needed.
A pilot starts from a single export. There’s no integration to approve.
Masked on ingest
When chats are ingested, Sioona masks email addresses, phone numbers, tax and national ID numbers, and long account numbers. We still recommend redacting before you share an export. Masking is defense in depth, not a replacement for your own data controls.
What we store
Redacted message text, the signals detected in it, and your team’s review decisions, including which signals were marked Acted.
What we don’t need from you
- Live mailbox access
- API keys for your chat tools
- CRM credentials
Compliance and certifications
We haven’t published compliance certifications or an audit report yet. If your security team needs specifics before a pilot, tell us what you need and we’ll answer directly.
Data facts before you share
The pilot request form is for business contact details. Customer exports come later, after the data terms are agreed.
- Retention and deletion
- Customer exports require an agreed pilot retention window, deletion process and backup handling before transfer. The contact-data policy below applies only to pilot enquiries.
- Storage and region
- Pilot data includes redacted message text, detected signals and review decisions. Confirm export storage providers and region for your pilot before transfer.
- Encryption and access
- Request the pilot’s encryption-at-rest, transport and operator-access details during security review. Published certifications and an audit report are not available yet.
- DPA and subprocessors
- Ask for a data processing agreement and subprocessor details in your pilot request. Confirm the required documents before sending customer data.
A standard contact-data retention period is not published yet.
Pilot request database hosting region: AWS US East 1 (Northern Virginia)
For access, correction, deletion or help with a pilot request, use the contact form.
Request a pilot
Find out what your chats already know.
Start with one export. Review the signals with your team, and let the Signal Score tell you whether to go.