“Your proprietary training data, personal information, and customer interaction logs will never be used to train, fine-tune, or improve Realfy’s foundational AI models. That commitment is contractual, not aspirational.”

Realfy Privacy Policy

Most AI vendors reserve the right to improve their models with the data you submit. Read the terms closely and you will usually find it, phrased as service improvement.

The Realfy Data Guarantee closes that door. Everything your customers share with your agents, every objection they raise, and every reason they choose you remains your commercial asset. It is never routed into a model that also serves your competitors, and this position is set out in the document that binds us rather than the one that markets us.

Where Realfy runs

Standard, all plans

Realfy cloud

Your agents run on Realfy’s infrastructure, hosted on AWS. Data is encrypted in transit and at rest, protected by strict access controls and network segmentation.

Enterprise, on request

Your environment

For organisations whose policy requires that data does not leave their perimeter, we deploy into a private VPC within your own cloud account, or operate localized models inside your environment.

This is an enterprise option rather than the default, and it is scoped during the demo and pricing call. If your security policy requires it, state the requirement on the audit call and we will confirm immediately whether we can meet it.

Most customers operate on Realfy cloud. We would rather explain the distinction honestly than imply that every account receives a private deployment.

How your data is handled

ENCRYPTION: Data is encrypted in transit and at rest across our databases and data stores.
ACCESS CONTROL: Strict role-based access controls and network segmentation are enforced across our infrastructure.
RETENTION: We retain your data for the duration of your active account, or for as long as necessary to deliver the service.
DELETION: Upon deletion, we immediately disconnect your AI agents from all third-party channels and systematically remove your proprietary training data, customer interaction logs and profile information from our active servers. Transactional records required by tax and accounting law are the sole exception.
CONSENT FOR VOICE AND FACE: A cloned voice or face requires the documented consent of the individual it belongs to. This is a condition of use, not a configurable setting.

Residency and transfers

Realfy Inc. is a United States company operating globally distributed infrastructure.

Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to the United States, we rely on legally recognised transfer mechanisms: Standard Contractual Clauses and adherence to the EU to US Data Privacy Framework.

Our full Data Protection Policy sets out the detail, including how to exercise data subject rights.

Subprocessors

The third parties that process data on our behalf, and the scope of each engagement.

Provider	Purpose	Data involved
Amazon Web Services	Hosting, storage and compute	All service data
Stripe	Payment processing	Billing and payment details
Google Workspace APIs	Email and calendar integration, where you connect it	Messages and calendar events you authorise
Meta, Instagram, WhatsApp, Telegram	Channels where you choose to deploy agents	Conversations conducted on that channel

We will notify customers of material changes to this list. For the full subprocessor detail required for a vendor review, contact our Data Protection Officer.

Your rights over your data

Under GDPR and comparable regulatory regimes, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format.

You can exercise these rights through your account settings, or by contacting our Data Protection Officer directly. Our Data Protection Policy sets out the process and applicable timeframes.

Compliance status and disclosures.

A complete compliance posture takes time to build. Rather than present gaps as a surprise late in your evaluation, we list every certification and control not yet in place below, alongside our planned timeline for each.

SOC 2 TYPE II: Realfy does not hold SOC 2 Type II today. We plan to initiate the audit process between Q4 2026 and Q1 2027, and this page will be updated with the auditor and the expected completion date once the programme is underway.
ISO 27001: Realfy does not hold ISO 27001. It sits within the same compliance programme, planned to begin between Q4 2026 and Q1 2027.
HIPAA: Realfy is not a HIPAA covered entity or business associate. Realfy must not be used to process protected health information.
PENETRATION TESTING: We have not yet commissioned an independent penetration test. One is planned as part of the compliance programme beginning Q4 2026.

Available in the interim: the Data Guarantee in writing, Standard Contractual Clauses, adherence to the EU to US Data Privacy Framework, a designated Data Protection Officer, a signed Data Processing Agreement on request, and private VPC or localized deployment for enterprise accounts that require it.

If your review requires a control we have not covered, tell us what is missing rather than assuming the answer is no.

Talk to us about security

Data Protection Officer
Realfy Inc.
2450 Colorado Avenue, Suite 100E
Santa Monica, 90404 California
United States of America
hello@realfy.ai

Send us your security questionnaire and we will complete it in full. If you require a Data Processing Agreement, ask and we will provide one.

For anything this page does not address, write to the address on the left. We would rather answer a difficult question early than lose a deal to a gap we could have closed.

If security requirements are what stand between you and a decision, bring them to the audit call.

Book your audit call