POLYONPOLYON

POLYON

Security

How we protect your data and account.

At POLYON, security is the floor — not a feature. Below is an overview of how we protect your data, account, and conversations.

Encryption

  • In transit: TLS 1.3 for all client-to-server traffic. Certificate pinning in mobile apps. HSTS enforced.
  • At rest: AES-256 encryption for data stored in our databases and object storage.
  • Backups: encrypted with separate keys, rolling 30-day window, restored regularly to verify integrity.

Authentication

  • Passwords hashed with Argon2id with per-user salts.
  • Optional two-factor authentication (TOTP, WebAuthn / passkeys coming Q1 2027).
  • OAuth via Google and Apple as alternatives — we never see your password for these.
  • Session tokens are short-lived (1 hour) with refresh-token rotation. Suspicious activity triggers automatic re-authentication.

Infrastructure

  • Hosted on AWS with multi-region failover.
  • Network: VPC isolation, private subnets for databases, no public ingress to data stores.
  • Edge protection via Cloudflare: DDoS mitigation, WAF rules, bot management.
  • Secrets managed in AWS Secrets Manager with monthly key rotation.

AI provider security

  • We work only with AI providers that contractually commit not to train on user data without explicit opt-in.
  • POLYON's backend is the only thing that holds API keys for OpenAI, Anthropic, Google, OpenRouter, and others. Client apps never see provider keys.
  • Per-user identifiers passed to providers are tokenized — never your email or name.

Application security

  • Daily dependency vulnerability scans.
  • Static analysis (SAST) on every pull request.
  • Manual code review required for all production changes.
  • Penetration tests by third-party firms at least annually.
  • Bug bounty program — see below.

Compliance

  • SOC 2 Type II: readiness in progress (target: 2027).
  • ISO 27001: certification roadmap.
  • GDPR / LFPDPPP / DPDP Act / CCPA: operationally compliant.
  • PCI-DSS: we never store full card data; all payments handled by certified processors (Stripe, RevenueCat).

Bug bounty

Found a vulnerability? Report it to security@polyon.ai. We follow responsible-disclosure principles and acknowledge serious findings publicly (with your permission) and may offer monetary rewards based on severity.

Incident response

We monitor for security events 24/7. In the event of a confirmed breach affecting your data, we will notify affected users without undue delay and in accordance with applicable law.

Contact

Security questions or reports: security@polyon.ai · PGP key available on request.

← POLYON