Built for businesses that
cannot afford a leak
Aqlon handles the enquiries your customers trust you with, appointments, health questions, personal details. This page sets out exactly how that data is protected, who can reach it, and what we have and have not yet done. No claim on this page is aspirational.
Where your data lives, and who can see it
In Qatar. Your database, conversation transcripts and audit logs sit in a data centre in Doha, and backups stay in the same region. The media servers carrying a voice call run there too, so call audio does not leave the country to be carried.
What leaves Qatar is the thinking, not the storage. The AI that writes a reply and the speech services that handle a call run abroad, each named in your Data Processing Agreement. Your WhatsApp history also sits with WhatsApp and your email in your own mailbox, as both did before us.
Separated by client
Every record carries the client it belongs to, and every request is checked against the account making it. A login for one business cannot read another's calls, customers, bookings or messages. This is enforced in code and covered by an automated test that fails the build if it ever stops being true.
Encrypted in transit
All traffic runs over TLS. HTTP Strict Transport Security is enforced with a one-year policy, so a browser will not fall back to an unencrypted connection even if asked to.
Numbers masked in the portal
Customer phone numbers are masked before they leave the server, staff see 974•••402, not the full number. Opening a customer's history uses a one-way reference, so the real number never reaches the browser at all.
Personal data stripped from diagnostics
Our error monitoring receives the location and type of a fault, never the contents of a conversation. Request bodies, cookies and query strings are discarded before an error report is sent, and credential-shaped fields are redacted.
Retention you set
Conversations are deleted automatically at the end of the retention period you choose. Erasure requests remove a person's conversations, customer record and call history.
Passwords we cannot read
Your staff choose their own portal passwords, stored as scrypt hashes. We issue a one-time code; the password itself is never transmitted to us or recoverable by us, if it is forgotten, it is reset, never retrieved.
Getting in is deliberately hard
- Rate limiting and lockout. Repeated failed logins lock that account and address for fifteen minutes. Responses never reveal whether an account exists.
- Leaked-password screening. New passwords are checked against known breach corpora before being accepted. Only a partial hash prefix leaves our servers, the password never does.
- Password policy. Minimum length enforced, common and self-referential passwords rejected.
- Session control. Sessions expire after 24 hours and can be revoked immediately. Resetting a user's access invalidates their password and signs out every open session at once.
- Signed webhooks. Messaging platforms must prove each incoming message genuinely came from them. Unsigned or altered payloads are rejected, so nobody can impersonate a customer to your AI.
- Fail closed. If a security credential is missing or misconfigured, the affected service refuses to run rather than falling open.
A record that cannot be quietly edited
Every AI decision, staff takeover, approval and security event is written to an append-only audit trail. Each entry cryptographically includes the hash of the one before it, so removing or altering any record breaks the chain and is detectable. Exportable at any time for a compliance review or a dispute.
Prompt-injection defence
Incoming messages are scanned for attempts to manipulate the AI into ignoring its instructions. Flagged input is blocked before it reaches the model and recorded as a security event.
Human approval for sensitive replies
Responses touching refunds, legal or medical matters can be held for a member of your team to approve, edit or reject before the customer ever sees them.
QFC Data Protection Regulations 2021
Aqlon acts as a data processor. Your business remains the data controller, it is your data, and we process it only on your instructions. We sign a Data Processing Agreement with every client before going live, covering purpose limitation, retention, sub-processors, breach notification within 48 hours, and deletion or return of data on termination.
Who else touches your data
We do not sell your data, share it with anyone outside the list below, or use it to train public AI models. These are the only categories of third party involved in delivering the service, and exactly what each receives:
| Category | Purpose | What it receives |
|---|---|---|
| Language model provider | Understanding messages and drafting replies | Conversation text, for the duration of the request. Not retained for training. |
| Telephony platform | Carrying the voice calls | Call audio and transcripts |
| Speech providers | Converting speech to text and back | Audio and text of spoken turns |
| WhatsApp Business provider | Sending and receiving WhatsApp messages | Message content and sender number |
| Cloud hosting | Running the application and database | All stored records |
| Error monitoring | Alerting us when something breaks | Fault type and location only, never conversation content |
Each provider is named individually in your Data Processing Agreement, along with its location and the safeguards that apply. We notify you before adding or replacing any of them, and you can ask for the full named list at any point during evaluation.
The answers a buyer wants in writing
What happens if you have a breach?
You are notified within 48 hours of us becoming aware: what happened, which records, and what we are doing about it. Notifying the regulator is yours to do, and we support you in doing it.
What happens to our data if we leave?
Your knowledge base and configuration are exported to you within 7 days. Customer data is deleted within 30 days, or sooner on request.
Can it run on our own infrastructure?
It can be built to. The system is a Node application, a PostgreSQL database and containerised voice services, with nothing only we can run. No deployment works this way today, so it is scoped as a project rather than ordered as a product.
What we have not done
Every vendor security page lists strengths. These are the questions a careful buyer asks next, answered plainly.
Are you ISO 27001 or SOC 2 certified?
No. Neither certification has been undertaken. The controls described on this page are real and verifiable, but they have not been audited by an external body.
Has the system been penetration tested?
Not by an independent third party. Security work to date has been internal review and automated testing.
Questions this page did not answer
Send them to contact@aqlon.co. If your IT team has a security questionnaire, we will complete it.
Talk to us →