Jylo Book

Jylo Book hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Jylo Book is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Jylo Book hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@jylo.ai or via a /security page (Jylo Book lists a security contact).

Jylo Book lists 3 subprocessors on its trust center, including Auth0, Microsoft Azure, Amazon Web Services. Buyers use this for fourth-party risk review.

Jylo Book hosts on AWS, Azure. Data residency details are on its trust center.

Jylo Book's trust center is at https://trust.jylo.ai. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

No, Jylo will never use Customer Data for any purpose. Our Master Framework Agreement includes a specific term to ensure that customers have contractual certainty that Jylo will never have any rights to Customer Data, even beyond the duration of the agreement. The term states: The Customer shall: (i) own all rights, title and interest in and to all Customer Data in perpetuity; and (ii) have sole responsibility for the legality, reliability, integrity, accuracy, and quality of all Input Data; and (iii) retain assurance that Jylo will never use Customer Data for any purpose, including but not limited to training AI models through methods such as fine-tuning or Retrieval-Augmented Generation (RAG)." To eliminate any ambiguity, we explicitly specify how Customer Data cannot be used. Unlike other AI vendors who may have ambiguous terms, we ensure there is no "grey area." Some vendors have a "No AI Training" clause but still retain rights to use Customer Data to "provide and improve the services,". In our view, this could allow for improving AI through RAG. Our goal is to provide absolute certainty that Customer Data is not, and will never be, part of our business plan. We are open to amending our clause to provide further clarify or address any additional customer concerns.

Yes, a primary market for Jylo is the legal industry. In this industry, it is crucial to maintain legal privilege. Allowing any human-in-the-loop at Microsoft access to Customer Data to check for misuse would violate this privilege. Recognizing that the legal field is our core market, Microsoft has agreed to exclude our data processing from their misuse monitoring. We have shared evidence of this agreement within this Trust Center.

No, we don't allow this - not through lack of technical ability, but rather that providing this functionality would put our customers in a position where they would be breaching the Terms of Use for most websites, which have very clear prohibited use clauses that explicitly state web scraping is a civil contract breach. Whilst its true AI models were trained on the internet, the primary purpose of the model use in Jylo is more as a reasoning engine than a fact database. That puts the models more in a place of learning from the internet rather than regurgitating and replacing it. AI search tools that actively scan content, including new, updated content, and summarise or reason on that text without the permission of the website owner is, in our view, an unfair practice that doesn't promote the future of free open and shared publicly available internet.

We partner with Microsoft Azure, which means we can host Jylo anywhere in the world where there are Azure datacenters. Azure global infrastructure experience