Security Measures

This schedule describes the technical and organizational measures Elios Superintelligence, Inc. applies to the processing covered by its Data Processing Addendum. It is Schedule 2 to that DPA and, where applicable, Annex II to the relevant international transfer clauses.

The measures apply to the production systems that run Computer, Phone, the console and the Elios API. Any differences by product, deployment, region or feature are stated below. Measures that are not implemented must not be described as current safeguards.

#1. Governance and personnel

Security ownership and escalation: named members of Elios’s leadership are responsible for security and decide how incidents are escalated.

Personnel confidentiality: everyone with access to Customer Personal Data is bound by a contractual or statutory duty of confidentiality.

Risk review and change approval: material changes to how Customer Personal Data is processed are reviewed for security and privacy risk before they are released.

#2. Access control

Workforce access: Elios staff use accounts managed through WorkOS with multi-factor authentication to reach provider consoles and administrative tools. Access is limited to the people who need it for their work and is removed when they no longer do.

Production and support access: servers are reached with SSH keys, held only by the people who need them. Staff access Customer Content only when needed to provide support the customer asks for, to keep the Services secure, or to comply with law.

Customer access features: customers sign in to the console with one-time codes sent to their email through WorkOS, and use API keys created in the console to call the Elios API. Access to a resource through the API is limited to the account that owns it.

#3. Isolation

Workload isolation: each computer runs inside a gVisor sandbox, a user-space kernel that separates workloads from the host and from each other.

#4. Protection in transit

Transmission: data in transit to and from the Services is encrypted with TLS.

#5. Communications data

Phone signaling and media paths: calls and messages travel between the public telephone network and Elios through Elios’s carrier, BulkVS. Call signaling and live audio pass through Elios’s own call servers, hosted on AWS in the United States and Hetzner in the European Union. When a customer opens an audio session through the API, live call audio streams to the customer’s own systems. Elios does not transcribe calls.

Recordings, messages and attachments: calls are recorded only when the customer starts a recording through the API; recording is off by default. Each Phone keeps recordings, contacts, and call and message history within limits stated in the documentation; when recording storage or history reaches its limit, the oldest items are deleted first, and message attachments expire after a stated period. Deleting a Phone deletes all of its data.

Provider limits: calls and messages on the public telephone network are not end-to-end encrypted.

#6. Secure development and vulnerability management

Development and release practices: changes reach production only through people authorized to deploy them.

Vulnerability management: Elios accepts security reports under its Vulnerability Disclosure Policy at security@elios.ai, and fixes confirmed issues in order of severity.

#7. Logging and incident response

Logs: logs are kept for 30 days, with access limited to the people who need them.

Response: Elios contains and remediates Personal Data Breaches and notifies customers without undue delay, as Section 7 of the DPA requires.

#8. Recovery and physical safeguards

Backups: computers, disks and templates are backed up in the European Union, and backup copies roll off within 35 days.

Hosting and physical security: the Services run in data centers operated by Hetzner Online GmbH in the European Union and Amazon Web Services in the United States. Those operators provide the physical security of their facilities; Elios does not run its own data centers.

#9. Data lifecycle and individual rights

Retention and deletion: deleted computers, disks and templates are purged within 30 days. Deleting a Phone deletes its contacts, messages, call records, recordings and media within 30 days. Closed accounts are deleted within 30 days. Backup copies roll off within 35 days, and deletions are reapplied to any backup that is restored.

Export and access assistance: customers can export their data through the console and the API until their account closes. Elios assists with data subject requests as Section 8 of the DPA describes.

#10. Vendors and international transfers

Vendor terms: Elios engages each subprocessor under written terms that impose data protection obligations no less protective than the DPA.

Transfer safeguards: processing locations are stated in Schedule 1 of the DPA and on the Subprocessors page. Restricted transfers rely on the Standard Contractual Clauses and the UK and Swiss provisions in Schedule 3 of the DPA.

#11. Changes

Changes are managed under the DPA’s requirement not to materially reduce the overall protection of Customer Personal Data. The accepted version of this schedule is retained with the customer agreement.

#12. Independent assurance

Elios is actively working toward a SOC 2 report. A SOC 2 report is not yet available. No completion date is promised in this schedule.

#13. Customer responsibilities

Customers control the code, agents, content, instructions, credentials and third-party services they use. They should configure available access controls, limit agent permissions, protect their own systems and maintain backups appropriate to their use. These responsibilities do not replace Elios’s obligations under the DPA.