Question 1

Where is customer data stored?

Accepted Answer

In EU-based infrastructure regions by default. EU residency covers application data and backups; the providers involved, and where each is established, are listed under subprocessors on this page.

Question 2

Is Inly ISO 27001 certified?

Accepted Answer

No. Certification is in progress. Our controls are aligned with ISO/IEC 27001 today, which is what the control list on this page describes.

Question 3

Is Inly GDPR compliant?

Accepted Answer

Yes. A data processing agreement is signed on contract, EU data residency applies by default, and rights to insight, correction, and deletion are handled per GDPR. The full disclosure is at inly.se/gdpr.

Question 4

Do you support SSO and two-factor authentication?

Accepted Answer

Two-factor authentication is mandatory on all systems that handle sensitive data. Single sign-on through a central identity provider is prioritized wherever the system supports it.

Question 5

What encryption is used in transit and at rest?

Accepted Answer

AES-256 at rest for databases and object storage. TLS 1.2 or 1.3 in transit, for all communication.

Question 6

How is customer data isolated?

Accepted Answer

Each client's solution runs in its own server environment. Where a solution is multi-tenant, it follows database-separation best practices.

Question 7

How are backups handled?

Accepted Answer

Databases support point-in-time recovery with a seven-day retention window. Long-term backup storage sits in AWS S3 in the EU.

Question 8

How do you notify customers of a security incident?

Accepted Answer

Incident management follows a documented process. For critical incidents the affected client is informed immediately and the root-cause analysis is documented.

Question 9

Is customer data used to train AI models?

Accepted Answer

No. AI features in Core run through OpenAI's API. Customer prompts and outputs are not used to train OpenAI's models, and OpenAI may retain API content for up to 30 days for abuse monitoring before deletion.

Question 10

How do I report a security vulnerability?

Accepted Answer

Email hello@inly.se with what you found and how to reproduce it. We welcome reports from the security community and will confirm receipt. We don't run a bug bounty programme.

FAQ