Data and security

How Aimy handles your documents, your conversations and the keys you give us, described as the product actually works. If you need something in writing for a security review, send a ticket from Submit a ticket in your account menu, or talk to our sales team.

Your documents stay yours

We never use your documents to train AI models. Your Knowledge Base belongs to your company alone, no other Aimy customer can reach it, and we do not mine it for any other purpose.

Each company is kept separate

Your documents, conversations and settings are visible only to people in your company. Every request is limited to the company it belongs to, so one company's data is never mixed with another's.

Inside your company you can narrow things further. On the Professional plan you can restrict documents to particular teams. See Restricting documents and Teams and roles.

Where your data is processed

Aimy runs its own AI models for indexing, search and the Aimy hosted chat models, on infrastructure we control. Your documents are uploaded to and indexed on our servers. They are not handed to an outside cloud to store.

You choose the model each expert uses, and that choice matters here. If you pick a model that belongs to an outside provider, or you connect your own account under Provider, Aimy sends that provider the question together with the passages it found in your documents, so the provider can write the answer. The provider handles that text under its own terms. With an Aimy hosted model, the whole request stays on our infrastructure. See AI models.

Encryption and secrets

• In transit. Traffic between your browser, our servers and the AI layer is encrypted with TLS.
• Keys and passwords you give us. A provider key, a SharePoint client secret and a database password are stored encrypted, and each one is decrypted only when Aimy needs it to act for you. A key is shown as its last few characters, and a company admin can reveal a provider key. Each reveal is recorded in the audit log.
• REST API keys. Aimy keeps only a fingerprint of each key, so a lost key cannot be read back by anyone. Revoke it and create a new one. See REST API.
• Access. Documents and conversations sit behind sign in, and files are stored on access controlled servers.

Signing in

These are the facts a security review usually asks about the sign in to the hub, which is also how people reach Aimy Expert.

• Passwords are stored hashed. Aimy keeps a one way hash of each password, never the password itself, so nobody at Aimy can read it back. A new password needs at least 8 characters, one number and one special character, and a reset has to meet the same rules.
• The sign in page does not reveal who has an account. A wrong password and an email address with no account get the same reply: Those details do not match an account. The forgot password page also gives the same answer whether or not the address is registered.
• Email is confirmed. A new account must confirm its email address with a six digit code before it can open any product. The code lasts 15 minutes, and ten wrong codes lock that page for 15 minutes.
• Reset links are short lived. A password reset link works once and expires after 30 minutes. Asking for a new link cancels the earlier one.
• A fresh session at every sign in. The session is renewed when you sign in, and signing out ends it.
• Not offered today. Aimy has no two factor sign in, no single sign on, and no Remember me option. Everyone signs in with an email and a password, and may be asked to sign in again when the session ends.

Each sign in, sign out, failed sign in, password reset request and password change is written to the audit log. A failed attempt is recorded with its reason, either a wrong password or no account for that address. When the address belongs to an account, the entry appears in that organisation's log. The sign in page does not lock an account after repeated failed attempts, so choose a strong password, and use the reset link if you think one has been guessed. On the Professional plan, your admins can read these entries in Audit Logs.

Seeing what changed

On the Professional plan, the audit log records sign ins, document changes, invitations, integration changes and more, and keeps them for 365 days. See Audit logs.

How long things are kept

• Conversations are kept for 30 days on Business and 365 days on Professional, and older ones are deleted. See History.
• Documents are kept until you delete them or the account is deleted.
• After a plan ends, your experts are switched off, your data is kept for 30 days, and after that the account can be deleted. See Upgrade and renew.
• REST API request records are kept for 30 days.

Deleting data

• A document. Delete it from the Knowledge Base. The document and what Aimy learned from it are removed, so it stops appearing in answers.
• Chats. A person can clear their own chats from the chat settings. That removes them from their own list. A conversation held with a company expert also stays in the company's History for its admins until the retention period above runs out.
• The whole account. Email support@aimy.com.my. Once we have checked the request and processed it, the account and its data are removed for good.

Compliance

Aimy follows the Malaysian Personal Data Protection Act (PDPA). For the details, read our Privacy Policy and PDPA Notice.