Security
Your data will never train our models.
That is a guarantee written into our privacy policy, not a promise on a marketing page. Below is everything else a security review needs.
Last reviewed: August 30, 2026
Quick answers
No. Never. It is written into our privacy policy.
AWS, on globally distributed infrastructure. Realfy Inc. is a US company.
Yes, on enterprise plans. Private VPC or localized models.
Yes, in transit and at rest.
Standard Contractual Clauses, the EU to US Data Privacy Framework, and a named Data Protection Officer.
Not yet. We say so plainly below rather than let you find out in a questionnaire.
The Realfy Data Guarantee
“We explicitly guarantee that we will NEVER use your proprietary training data, personal information, or Customer interaction logs to train, fine-tune, or improve Realfy’s own foundational AI models.”
Most AI vendors reserve the right to improve their models using what you put into them. Read the terms carefully and you will usually find it, phrased as service improvement.
We do not do this, and we committed to it in the document that binds us rather than the one that markets us. Your conversations with your customers are your commercial knowledge. Every objection your buyers raise, every reason they choose you, every price they push back on. That belongs to you, and it should not end up improving a model that also serves your competitors.
Where Realfy runs
Standard, all plans
Realfy cloud
Your agents run on Realfy’s infrastructure, hosted on AWS. Data is encrypted in transit and at rest, held behind strict access controls and network segmentation.
Enterprise, on request
Your environment
For organisations whose policy requires that data does not leave their perimeter, we deploy into a private VPC in your own cloud account, or run localized models inside your environment.
This is an enterprise option rather than the default, and we scope it during the demo and pricing call. If your security policy requires it, say so on the audit call and we will tell you straight away whether we can meet it.
Most customers run on Realfy cloud. We would rather explain the difference honestly than imply every account gets a private deployment.
How your data is handled
- ENCRYPTION
- Encrypted in transit and encrypted at rest in our databases.
- ACCESS CONTROL
- Strict access controls and network segmentation across our infrastructure.
- RETENTION
- We retain your data for as long as your account is active, or as long as needed to provide the service.
- DELETION
- On deletion we immediately disconnect your AI agents from all third-party channels and systematically delete your proprietary training data, customer interaction logs and profile information from our active servers. The exception is transactional data we are required to keep by tax and accounting law.
- CONSENT FOR VOICE AND FACE
- A cloned voice or face requires the consent of the person it belongs to. This is a condition of use, not a setting.
Residency and transfers
Realfy Inc. is a United States company operating globally distributed infrastructure.
When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to the United States, we rely on legally recognised transfer mechanisms: Standard Contractual Clauses and adherence to the EU to US Data Privacy Framework.
Our full Data Protection Policy sets out the detail, including how to exercise data subject rights.
Subprocessors
The third parties that process data on our behalf, and what each one does.
| Provider | Purpose | Data involved |
|---|---|---|
| Amazon Web Services | Hosting, storage and compute | All service data |
| Stripe | Payment processing | Billing and payment details |
| Google Workspace APIs | Email and calendar integration, where you connect it | Messages and calendar events you authorise |
| Meta, Instagram, WhatsApp, Telegram | Channels where you choose to deploy agents | Conversations conducted on that channel |
We will notify customers of material changes to this list. If you need the full subprocessor detail for a vendor review, contact our Data Protection Officer.
Your rights over your data
Under GDPR and comparable regimes you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format.
You can exercise these through your account settings, or by contacting our Data Protection Officer directly. Our Data Protection Policy sets out the process and the timeframes.
What we do not have yet
We are a small company. We would rather tell you what we do not have than let you discover it three weeks into a procurement review.
- SOC 2 TYPE II
- We do not hold SOC 2 Type II today. We plan to begin the audit process between Q4 2026 and Q1 2027, and we will update this page with the auditor and the expected completion date once it is underway.
- ISO 27001
- We do not hold ISO 27001. It sits in the same compliance programme, planned to begin between Q4 2026 and Q1 2027.
- HIPAA
- Realfy is not a HIPAA covered entity or business associate. Do not use Realfy to process protected health information.
- PENETRATION TESTING
- We have not yet commissioned an independent penetration test. One is planned as part of the compliance programme beginning Q4 2026.
What we can offer in the meantime: the Data Guarantee in writing, Standard Contractual Clauses, adherence to the EU to US Data Privacy Framework, a named Data Protection Officer, a signed Data Processing Agreement on request, and private VPC or localized deployment for enterprise accounts that need it.
If your review needs something we have not covered, tell us what is missing rather than assuming the answer is no.
Talk to us about security
Realfy Inc.
Lewes, Delaware 19958
United States of America
hello@realfy.ai
Send us your security questionnaire and we will complete it. If you need a Data Processing Agreement, ask and we will send one.
For anything this page does not answer, write to the address on the left. We would rather answer a hard question early than lose a deal to a gap we could have closed.
If security requirements are what is standing between you and a decision, bring them to the audit call. Thirty minutes, and you keep the written analysis either way.
Book your audit call