Built for Trust.
Kario.ai is designed to protect your live customer calls and the sales and customer data behind them.
Your data stays put
In AWS data centers in the United States and India.
You stay in control
We surface insights and factual recommendations in real-time.
Always encrypted
Data encrypted in transit, and at rest on our servers.
Your data is yours
Identifiable data is never used to train models.
Security program
Comprehensive security controls, backed by written policies, procedures, and a program for continuous improvement.
Identity and Access
Myriak enforces unique identity per person, role-based least-privilege access, multi-factor authentication, and quarterly access reviews.
Encryption and Key Management
Myriak encrypts data at rest with AES-256 and in transit with TLS 1.2 or higher, with keys held in a hardened key management service under restricted access and scheduled rotation.
Infrastructure Security
Myriak hosts the platform on Amazon Web Services (AWS), relying on AWS for facility access control, surveillance, redundant power, climate control, and fire suppression.
Data Classification and Handling
Myriak classifies information into four levels with defined storage, transmission, and AI-tool handling rules, applying its highest customer protections to platform data and to the prompts and outputs generated in serving you.
Retention and Data Destruction
Myriak maintains customer data for the life of your contract and deletes it at contract termination using data sanitization techniques.
Secure Development
Myriak follows a secure software development lifecycle (SSDLC) with security-by-design, code review, static, and dynamic vulnerability scanning, and bill-of-materials tracking.
Change and Configuration Management
Myriak controls production change through recorded, approved, tested, and reversible releases, pipeline-only deployment, infrastructure-as-code configuration management, and a documented emergency change path.
Monitoring and Incident Response
Myriak logs authentication, customer data access, administrative action, and AI system use to tamper-protected storage with alerting, and runs a documented incident response process with CVSS-based severity and defined response targets.
Business Continuity and Backup
Myriak maintains encrypted backups separated from production and protected against deletion, with defined recovery point and recovery time objectives, documented continuity procedures, and scheduled restoration testing.
AI Governance
Myriak governs AI under a dedicated policy aligned to the NIST AI RMF 1.0 and ISO/IEC 42001:2023, with an AI system inventory, risk assessment and evaluation, and ongoing monitoring of production output.
Third-Party and AI Supply Chain
Myriak assesses critical vendors before engagement and on a defined cycle, with contractual security obligations, incident notification requirements, and subprocessor disclosure.
Privacy and security principles
Three commitments that shape how Kario.ai is built, not controls bolted on afterward.
Security-by-Design
Myriak builds security in from requirements through release, with threat consideration at design time, secure coding standards, peer code review, and security testing.
Privacy-by-Design
Myriak collects only the data the service needs, encrypts information in transit and data stored on its servers at rest, and applies formalized retention and destruction practices.
Responsible AI-by-Design
Myriak tests the models, builds guardrails, and maintains a feedback and monitoring process to evaluate and improve responses.
Data processing
- Stored securely
- Your data is encrypted at rest in our AWS data centers in the United States and India.
- Processed securely
- Your data is transmitted securely in transit from our web and mobile apps to our AWS cloud and our approved third-party AI-model vendors.
- Model training
- Your identifiable data is not used to train models. We may use anonymized, de-identified data to improve the service, as set out in the Kario.ai Terms and Conditions.
Built on recognized frameworks
Our framework is informed by recognized standards, including ISO/IEC 27001, NIST, and AIUC-1. Completed CAIQ v4.0.3 and AI-CAIQ v1.0.2 self-assessments are available on request.
Documents
We provide supporting security documents under confidentiality terms. Select what you need and provide your contact information, and we will follow up with you directly.
Trusted AI FAQ
Straight answers to the questions your security team will ask.
Does Kario.ai record our calls?
Yes. Kario.ai records and transcribes the ambient audio of the call. The audio recording, transcript and summary are stored so you can access them from the Kario.ai app. They are encrypted in transit and at rest on our servers, and governed by formalized retention and data destruction practices.
How are participants informed about call recording?
Kario.ai shows an on-screen notice whenever listening or transcription is running. Giving notice and obtaining any consent the law requires is your responsibility — including the all-party consent rules in states such as California, Pennsylvania and Washington.
Is our conversation data used to train AI models?
Not your identifiable data. Our agreements with our approved AI-model vendors prohibit them from training on Myriak or customer data. Myriak may use anonymized, de-identified data to improve the service, as set out in the Kario.ai Terms and Conditions. If you ask us to delete your data, we will.
Which AI vendors do you use, and what do you send them?
Our approved AI-model vendors are named in our subprocessor list, available for download above, with the regions they run in. We tell you before that list changes. They receive the part of the conversation that matters plus the product knowledge your team has loaded. Personal information, credentials and encryption keys are never sent to a tool not approved to handle them.
Where is our data stored, and how long do you keep it?
In AWS data centers in the United States and India, and our approved third-party AI-model vendors. Information is encrypted in transit, and data we store is encrypted at rest. We keep your data for the life of your contract and delete it, using data sanitization techniques, at contract termination or when you instruct us to.
What if Kario.ai gets something wrong on a call?
Kario.ai suggests; your rep decides. We test the models, build guardrails, and maintain a feedback and monitoring process to evaluate and improve responses: accuracy is tested against a maintained evaluation set before any model change ships, production output is sampled against that set, and reported inaccuracies are logged and used to improve responses.
Could someone manipulate the AI through the conversation?
Anything reaching the model from outside a trusted instruction is treated as data, never as a command. We have strict cross-tenant protections and model input filtering. Attempts we detect are logged and handled as security incidents, and what the model returns is never executed.
Report a vulnerability
Found a security issue in Kario.ai? Tell us. Every report is recorded, assigned a severity, and answered within a defined target.
security@myriak.com