This Security Overview describes the technical and organizational measures Alcony, Inc. ("Alcony") applies to protect Customer Data processed through the Alcony platform (the "Services"). It is provided for informational purposes as part of Alcony's enterprise sales and security-review process and is updated periodically; the version referenced in an executed Order Form or DPA governs for that customer.
1. Architecture & Hosting
The Services are hosted on Amazon Web Services (AWS) in region, e.g., us-east-1, with optional secondary region for DR.
Infrastructure is provisioned via infrastructure-as-code and deployed across multiple availability zones for resiliency.
Application, database, and network layers are logically segmented; production and non-production environments are isolated.
2. Encryption
In transit: all data transmitted to and from the Services is encrypted using TLS 1.2 or higher.
At rest: Customer Data is encrypted at rest using AES-256 (or equivalent), with keys managed via AWS KMS.
Encryption keys are rotated periodically in accordance with internal key-management procedures.
3. Authentication & Access Controls
Single sign-on is available via Google OAuth through Firebase Authentication. SAML/OIDC enterprise SSO and SCIM provisioning are not currently supported.
Multi-factor authentication (2FA) is not currently offered for customer user accounts.
Internal access to production systems is role-based, follows least-privilege principles, and requires MFA; access is reviewed periodically.
All access to Customer Data by Alcony personnel is logged and limited to what is necessary to provide support or maintain the Services.
4. Data Retention & Deletion
Customer Data is retained for the duration of the subscription term. Customer may request an export of its Customer Data at any time during the Subscription Term or following termination.
Upon the earlier of (a) Customer's written request, or (b) 30 days after Customer is no longer a subscriber to the Services, Alcony will delete Customer Data from production systems within 30 days, in accordance with the DPA. Residual copies in backups age out as part of Alcony's normal backup retention cycle (see Section 5, Backups).
Deletion today is carried out as a manual internal process by Alcony's engineering team upon the trigger above, completed within the committed 30-day window either way; it is not yet an automated self-serve pipeline. Automated export/deletion tooling is on Alcony's roadmap and can be prioritized if required at scale.
Alcony does not currently offer customer-configurable retention settings (e.g., custom log or conversation-history retention periods).
5. Backups
Automated encrypted backups are taken daily, with point-in-time recovery for X days.
Backups are stored in a separate, access-controlled location and are periodically tested for restorability.
6. Logging & Monitoring
Alcony has implemented a range of application-level security controls, including rate limiting, tenant-scoped access control enforcement, audit logging of key administrative actions, and automated dependency vulnerability scanning on every code change. A centralized infrastructure monitoring and alerting platform is planned but not yet deployed.
Automated infrastructure alerting (anomalous access patterns, error-rate spikes, infrastructure health) is planned but not yet implemented.
Alcony maintains an internal, append-only audit log of key administrative actions. Broader coverage and customer-facing access to audit logs are planned but not yet available.
7. Subprocessors & Model/API Providers
Alcony uses a limited set of subprocessors to deliver the Services, including cloud hosting, monitoring, authentication, and AI model/API providers. The current, complete list is maintained in the standalone Subprocessor List, which is updated as providers change and made available to customers with advance notice of material additions, consistent with the DPA.
8. Use of Customer Data to Train Models
Alcony does not use Customer Data to train or fine-tune AI/machine learning models for the benefit of any party other than the Customer from which the data originated, except with the customer's prior written consent. Where Alcony relies on third-party model providers (e.g., for AI features), those providers are engaged under terms that prohibit use of Customer Data to train their general-purpose models, consistent with the AI & Data Terms exhibit.
9. Shared vs. Dedicated Hosting
By default, Customer Data resides in a multi-tenant environment with logical isolation enforced at the application and database layer (tenant-scoped access controls, no cross-tenant data access). A dedicated / single-tenant deployment is available as a paid add-on for enterprise customers with additional isolation, network, or compliance requirements; see the applicable Order Form.
10. Incident Response
Alcony maintains a documented security incident response plan covering detection, containment, eradication, and recovery.
In the event of a confirmed security incident affecting Customer Data, Alcony will notify affected customers without undue delay, with timing and communication tailored to the nature and severity of the incident, and in any event consistent with the notice period in the DPA.
Post-incident, Alcony will provide a summary of the incident, impact, and remediation steps upon request.
11. Compliance & Certifications
Pending final copy
12. Security Contact
Security questions, questionnaires, and vulnerability reports: security@alcony.io / responsible disclosure policy link.