Claims register

Primary application data for Lyyli customer workspaces is stored and processed in the EU region.

Scope: Workspace storage, Supabase database, and primary application database.

Exceptions: AI processing, user authentication metadata, email delivery, system analytics, and certain subprocessors may process data outside the EU/EEA as documented in the vendor register and DPA.

AI route retention and ZDR practices are documented in the AI model register; ZDR enforcement is not currently visible in application code.

Scope: AI routes via the OpenRouter gateway and direct AI partners, to the extent a route is confirmed.

Exceptions: Code does not show ZDR headers or no-logging enforcement. Claude and GPT routes are not confirmed active. Processing region, retention, and ZDR require separate config and contract evidence. Row-level detail: AI model register.

Customer content is not used to train AI models.

Scope: AI integrations and AI processing routes.

Exceptions: Providers' possible legal exceptions and abuse monitoring practices depend on the customer's selected route and that provider's own contractual terms.

Data is protected in transit and at rest in line with industry standards.

Scope: Application layer and infrastructure layer.

Exceptions: The system does not use end-to-end encryption. The Lyyli application and infrastructure services we use process plaintext data to deliver the service and enable workflows.

Customer content deleted from the active system is removed without undue delay.

Scope: Lifecycle of customer-produced content and manual deletion.

Exceptions: Security logs, audit trails, and legal exceptions are retained on a separate, protected schedule. Copies of deleted data may remain in automated backups for a limited period before being overwritten.

Information security practices (ISMS) are developed in line with the ISO 27001 framework.

Scope: Organisational security governance and controls.

Exceptions: Lyyli does not currently hold formal ISO 27001 certification. Certification under the standard is a future development goal and does not describe the system's current state.