Security Overview

Learn more about Pylon's Security

Enterprise-Grade Security

Pylon is built for companies that take security seriously. We serve customers across financial services, healthcare, and enterprise software—industries where data protection isn't optional.

Compliance & Certifications

We maintain the certifications your security team expects. Pylon holds active SOC 2 Type II and ISO 27001:2022 certifications, with annual audits to ensure ongoing compliance. Both our US and EU deployments are in scope. We're also GDPR compliant, with HIPAA BAAs and Data Processing Agreements available upon request.

All compliance documentation, including our SOC 2 report and ISO 27001 certificate, is available at trust.usepylon.com.

AI Security

Pylon uses AI to power intelligent support features. We've built our AI infrastructure with enterprise security requirements in mind.

We maintain zero data retention agreements with all AI providers, meaning your data is never stored by third-party AI vendors and is never used to train AI models. Customer data is isolated at the request level and never commingled with other customers during AI processing. All AI API calls are encrypted using TLS 1.2+.

AI inference and processing are performed in the same region where your data resides. For customers on our EU region, this means AI processing happens entirely within the EU.

Infrastructure

Pylon is hosted on AWS, leveraging AWS's SOC 2 and ISO 27001 certified environment. We operate two regions: the United States (us-west-2, Oregon) and the European Union (eu-central-1, Frankfurt).

All data is encrypted using AES-256 at rest and TLS 1.2+ in transit. We perform daily encrypted backups, replicated within the same region boundary as the source data, and maintain network isolation through VPCs, network segmentation, and security groups.

Enterprise Security Features

Pylon gives your team the controls they need to meet your security and compliance requirements.

For identity and access management, we support SSO via SAML 2.0 with providers like Okta, Azure AD, and Google Workspace. SCIM integration enables automated user provisioning and deprovisioning, and role-based access controls let you define granular permissions for your team.

For audit and compliance, Pylon provides comprehensive audit logs covering user activity and data access. Activity logs can be exported via API for integration with your SIEM. Data retention is configurable within the platform, with support for auto-deletion policies and on-demand deletion when needed. Full data export is available for compliance and portability requirements.

Security Practices

We conduct annual third-party penetration tests and run continuous vulnerability scans with defined remediation SLAs. Access to all systems follows the principle of least privilege, with quarterly access reviews.

Pylon support personnel access customer data only when actively working a support ticket. Access requires approval, and every access is logged.

Availability

We monitor service health around the clock. Check our current status and uptime history at status.usepylon.com.

Vulnerability Disclosure

We maintain an active vulnerability disclosure program. Security researchers can report vulnerabilities to [e-mail]. Visit https://www.usepylon.com/vulnerability-disclosure-policy for more details

Subprocessors

Pylon uses industry-standard third-party services for cloud infrastructure, AI processing, payment processing, and analytics. For a complete list of subprocessors, including the region each operates in, visit usepylon.com/subprocessors.

Frequently Asked Questions

Where is my data stored?

In AWS, either in the United States (us-west-2, Oregon) or the European Union (eu-central-1, Frankfurt). Your instance is assigned to one region, and your data is stored and processed there—it does not move between regions.

Do you offer EU data residency?

Yes. Customers on our EU region have their data stored and processed entirely within AWS eu-central-1 (Frankfurt), including AI inference. Backups replicate only within the EU.

Is my data used to train AI models?

No. We have zero data retention agreements with all AI providers. Your data is never used to train or improve AI models.

How quickly can my data be deleted?

Upon request, we can delete all your data within 72 hours. Contact [e-mail] for deletion requests.

Do you support security questionnaires?

Yes. Our SOC 2 Type II report is available under NDA at trust.usepylon.com, and we're happy to complete security questionnaires for prospective customers.

Contact

For security questions or to report a vulnerability, contact [e-mail].

For compliance documentation and our SOC 2 report, visit trust.usepylon.com.