Security

Niyoos sits in the path of your AI agents' calls and holds your AI provider keys, so security is the product, not a feature. This page describes what we do today, honestly, including what we have not done yet.

1. Where your data lives

• The service runs on Amazon Web Services in Mumbai, India (region ap-south-1): application servers, database, file storage, encryption keys and logs.
• All connections to app.niyoos.com and api.niyoos.com are encrypted with TLS.
• A few supporting services run outside India: sign-in (Clerk, United States), email sending (Resend, Japan) and website hosting (Vercel). See the Sub-processors page.

2. What we store, and what we don't

• Your agents' prompts and responses are not stored. The proxy forwards them to your AI provider and returns the answer; they pass through memory only.
• We store usage metadata for each call (model, tokens, cost, latency, outcome and similar), which powers your dashboard, limits and alerts.
• Tool details are off by default. If an Admin turns them on for an agent, tool-call arguments are masked, encrypted and deleted after 30 days.
• Loop detection uses one-way fingerprints of requests, held in memory for up to 24 hours. The request cannot be rebuilt from them.
• We never see your card, UPI or bank details. Payments happen on Razorpay's checkout.

3. Keys and secrets

• Your AI provider keys are encrypted with envelope encryption under AWS Key Management Service, decrypted only at the moment of forwarding your agent's call, and never written to logs.
• Agent keys are shown to you once and stored only as one-way hashes. Revoking a key removes the hash, so the key stops working straight away.
• Our own secrets are kept in AWS Secrets Manager.

4. Access control and isolation

• Sign-in is handled by Clerk. Niyoos never stores passwords.
• Two-factor authentication is available to every user. We strongly recommend it for every Admin, and the app reminds Admins who have not turned it on.
• Roles: Admins can change limits, keys, members and settings; Members can view.
• Every request is checked against the signed-in user's workspace on our servers. Automated tests check that one workspace cannot read or change another's data.
• Access to production systems is limited to the people who operate the service.

5. A record you can check

• Every important action in your workspace (keys created or revoked, limits changed, kill switch, members added, tool details viewed, plan changes) is written to an audit ledger.
• Entries are hash-chained and sealed, and anchors are signed with AWS Key Management Service, so a change to past entries can be detected.
• You can verify the ledger from the dashboard. People are recorded under pseudonyms, not names.
• Ledger copies older than 30 days are archived to storage that locks them against change for 90 days.

6. Controls that protect you from your own agents

Kill switch, daily and monthly spending limits, loop detection with automatic stops, and alerts by email. They refuse calls on our side, before your provider is charged.

7. Monitoring, logs and backups

• Application and security logs are kept for 365 days in India.
• We run alarms on errors and on failures of safety-critical writes.
• The database is backed up automatically; backups are kept for 7 days.

8. How we build and ship

• Every change runs through an automated suite of checks and tests before it can be deployed.
• Deployments are started manually and blocked if the checks fail.
• Dependencies are checked for known vulnerabilities.

9. Incidents

• We report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of noticing them, as Indian law requires.
• We notify affected customers within 48 hours of confirming a breach of their data, with what we know and what we are doing (see our Data Processing Agreement).

10. What we have not done yet

We would rather tell you than let you assume:

• We do not hold SOC 2 or ISO 27001 certification, and we have not commissioned an external penetration test. We will update this page when we do.
• The production database runs in a single AWS availability zone, so a zone outage can interrupt the service.
• Two-factor authentication is available but not enforced for every user.
• We have no public status page yet. Service notices appear in the app and by email.

11. Reporting a vulnerability

Found a security issue? Please tell us first. See our Responsible Disclosure page, or email support@niyoos.com with the subject "Security report".

12. Questions

support@niyoos.com · privacy@niyoos.com