Trust
Compliance status
In short. Seylo is a young company. We do not yet hold a SOC 2 report or an ISO 27001 certificate, and we do not offer HIPAA business associate agreements. This page says so plainly, and will change when that does — not before.
| Framework | Status today |
|---|---|
| SOC 2 | Not audited. No SOC 2 report is available. |
| ISO 27001 | Not certified. |
| HIPAA | Not offered. Seylo does not sign business associate agreements. Do not send protected health information to Seylo — including in resource names, labels, annotations, environment variables or alerts. |
| India — DPDP Act, 2023 | Our Privacy Policy sets out how we handle personal data and the rights it gives you, including our grievance officer. |
| EU / UK GDPR | Where it applies, our Privacy Policy covers your rights, and our Data Processing Addendum covers processing on your behalf. |
| Penetration testing | No independent penetration test has been published yet. |
What the design gives you today
Several things that compliance frameworks ask for are properties of how Seylo is built, not paperwork:
- Changes are proposed and approved by a person, by default.
- Every change is recorded in an append-only audit trail, and manifest history is hash-chained.
- Secret values never leave your cluster; telemetry stays in your cluster.
- Access is role-based, with SSO and multi-factor authentication.
Details are on our security and data-handling pages.
Questionnaires
For a security questionnaire or a call with the people who built it, email support@seylo.in.