Security
You are handing us your correspondence.
Here is what happens to it.
Nothing sends by itself unless you switch it on.
Automatic replies are off until you turn them on for a channel you name. Until then you send every message.
We never train on your messages.
They draft your replies, and they build your memory, the ranking that decides what you see first, and the per-contact figures sold as part of a plan. All of it is computed for your account alone and never pooled with another account.
Incoming text is data, never instructions.
A message telling us to forward your thread is treated as text. This is tested.
The agent never denies being an AI.
Asked if they are talking to a bot, drafting stops and you are told. No setting changes this.
Your channel logins use a key we hold for your account alone.
It covers those logins and your two-factor secret. It does not cover your message text. Deleting your account destroys the key, so those two stop being readable. For 7 days our database provider can still roll back to a state that has the key in it. After that it cannot.
You can take your data out.
Export on any plan, at any time. The archive holds your contacts and their identifiers, your threads, messages, attachment records, cards, drafts, outbox, the facts we extracted, your persona, rules, baselines, and the oldest ten thousand entries of your security log. It does not hold the sent messages your voice profile is built from, your conversations with the assistant, documents you uploaded, your follow-ups, your connected channels, agent settings, subscription record or profile fields. Write to us for those. Deletion is real, and receipted: your account leaves the live database the moment you ask. We cannot edit the 7 days of history our database provider keeps, or take one account out of it. After 7 days there is nothing left there to restore from.
A region is chosen once.
Your account stays in one jurisdiction.
Certifications
What we hold, and what we do not.
One of these is held. The rest are not, and they are listed anyway, because the question gets asked and an answer you have to dig for reads worse than a short no.
SOC 2Not held
Not held, and not claimed. A SOC 2 report is an auditor’s opinion about how controls operated over a window of months. SlyOS is too young to have that window, and buying the report before the history exists would mean buying a sentence rather than a fact.
ISO/IEC 27001Not held
Not held. It certifies a management system operating over time, which is the same problem as above and the same honest answer.
Independent penetration testNot held
Not yet commissioned. This is the one on the list we think is worth doing first, because it produces a finding you can read rather than a logo.
CSA STAR Level 1 (CAIQ v4.1.0)Held
Published on the CSA STAR Registry on 16 September 2026. It is a SELF-ASSESSMENT — 283 questions answered by us and published in full for anyone to read — and CSA does not verify the answers. That is the point of it: every answer is checkable against this site and against the addendum below, and 95 of the 283 are No. It is not a certification, nobody audited it, and we will not call it one.
CSA STAR for AI Level 1 (AI-CAIQ v1.1.0)Not held
Submitted and awaiting CSA review. Same shape as the entry above — a published self-assessment, this one about how the AI half of the product is run — and it will be linked to CSA’s own record here when it goes live, not before.
GDPRNot held
Not a certification anybody can hold. It is a law we are subject to. What we can show you is the addendum and the register below, which is what a controller actually needs from a processor.
What you can check instead
Everything above this section describes a control that exists in our code today. Two documents go further than a badge would:
Found a problem? Tell us
Write to support@belto.world. It reaches a person. There is no bug bounty — we are a small company and we would rather say so than imply one — but we will tell you what we did about what you sent.