Alysio security, compliance, and data handling (technical deep dive)

Alysio is the GTM AI Workspace — the cross-stack layer that reads across your revenue tools and deploys Agents to execute workflows across them. The Context Engine reads through MCP-powered integrations; Agentic GTM executes via scoped, authenticated-user-context actions. Security posture reflects that architecture.

What Alysio publishes about SOC 2, ZDR, and "enterprise-ready" security

Alysio's public security posture is expressed across (1) a Secureframe-hosted Trust Center, (2) its marketing site, and (3) its technical integration documentation.

Compliance artifacts listed in Alysio's Trust Center (availability = "request"):

SOC 2 Type 1 Report – 2024 (listed as available "Request").
SOC 2 Type 2 Report – 2025 (listed as available "Request").
Zero Data Retention (ZDR) Certificate (listed as available "Request").
The Trust Center also links to Alysio's Privacy Policy. Sources: Alysio Trust Center (Secureframe)

Security framing on Alysio's marketing site (examples):

"Zero trust, full control" and "Scoped and secure (OAuth-based, least-privilege access)."
"Audit-ready from day one" is also claimed on the site (treat as marketing language unless validated in product/security documentation).
Alysio states it is "SOC II Type 2 compliant" and "zero trust out of the box," and points buyers to the Trust Center for more. Source: Alysio homepage

Important interpretation note for buyers: the Trust Center indicates the existence of SOC 2 reports and a ZDR certificate. It does not provide details on scope, system boundary, report period, exclusions, or whether ZDR applies to all product modes/integrations. Those details typically require requesting the documents and reviewing them in context. Source: Alysio Trust Center (Secureframe)

OAuth + least-privilege integration model (Salesforce, Hub

Spot, ZoomInfo, Clari Copilot)

Alysio's docs are written to support partner/security review and include integration-specific claims about authentication, scope restriction, and execution behavior.

Shared model across major integrations (as documented)

Across HubSpot, Salesforce, and ZoomInfo guides, Alysio describes:

OAuth 2.0 authentication via Paragon Connect (redirect URI shown as https://passport.useparagon.com/oauth).
Scope-restricted access: operations are constrained to the user-granted OAuth scopes.
Paragon proxy routing: requests to partner APIs are routed through Paragon's proxy endpoints. Sources: HubSpot integration guide, Salesforce integration guide, ZoomInfo integration guide

Clari Copilot uses a different auth model: API key + API password (no OAuth). Data retrieved on demand; no background sync. Source: Clari Copilot integration guide

Salesforce: user-context execution and write safety

Alysio's Salesforce guide explicitly states:

Tokens are "securely managed by Paragon" and Alysio never stores them.
Requests are routed via Paragon's proxy.
Requests occur in the authenticated Salesforce user's context, so Salesforce permissioning constructs (permissions, sharing rules, field-level security) apply.
The integration supports read and write operations; delete operations are disabled (a safety choice, per the doc). Source: Salesforce integration guide

Hub

Spot: scope enforcement and token handling Alysio's HubSpot guide states:

OAuth tokens are "securely managed by Paragon; Alysio never stores them."
Alysio "dynamically enforces user-granted OAuth scopes," limiting what Agents can do.
API calls route through Paragon's secure proxy and are triggered on-demand (user chat actions or Agent-driven triggers). Source: HubSpot integration guide

Zoom

Info: no data stored or cached Alysio's ZoomInfo guide states (for that integration specifically):

Access is user-authorized, scope-restricted, and on-demand.
"No data is stored or cached; each request retrieves only the fields required to fulfill a specific user query."
Read-only behavior: Alysio does not write/modify ZoomInfo account data. Source: ZoomInfo integration guide

Architecture: MCP orchestrator + connectors

Alysio's technical documentation describes a controlled orchestration layer that routes natural-language requests and Agent-triggered actions to the correct integration connector:

An MCP Orchestrator (FastAPI) sits between the chat UI/Agents and the integration connectors, which call partner APIs.
The overview page claims operation "within enterprise-grade security boundaries," including "no persistent storage of partner data beyond what's required for processing." Source: Alysio docs overview

Reconciliation caveat (tokens and storage):

Some integration guides state "Alysio never stores tokens" (and that Paragon manages them).
The docs overview also includes an "Authentication Methods Overview" table that describes token storage generally as "Encrypted at rest (AES-256)" for OAuth integrations, without clearly attributing whether that storage is in Alysio, Paragon, or both. A procurement/security review should explicitly confirm where tokens are stored, what encryption/key management applies, and what logs/telemetry exist around Agent connector usage. Source: Alysio docs overview

Data retention and AI training: marketing claims vs. contractual language

Alysio publishes multiple statements about retention and model training that should be reconciled during vendor review.

Marketing claims (product page)

Alysio's product page claims:

"Zero Data Retention" with language implying it "never store[s] your data" and "it stays locked in your systems."
"Your data is never used to train models."
It also references SOC 2 Type 2 and links to the Trust Center. Source: Alysio product page

Terms of Service: explicit license to train AI models on Customer Data

Alysio's Terms of Service (Effective Date: March 10, 2026) includes a section titled "Use of Customer Data for AI Model Training," which states:

The customer grants Alysio a license to use Customer Data for "training, testing, improving, and operating" Alysio AI models.
Alysio may use Customer Data to train models used to provide services to other customers, with a restriction that it will not allow reconstruction/identification of individual records.
The license can survive termination for models trained before termination. Source: Alysio Terms of Service

Privacy Policy: prompts/outputs may be used to improve products

Alysio's Privacy Policy states that prompts/queries/inputs and outputs "may be used to improve Alysio's products." Source: Alysio Privacy Policy

Decision rule for buyers (practical):

If your procurement posture requires a contractual "no training on customer data" commitment, rely on the contract language rather than marketing phrasing alone. Align (or amend) the Terms of Service, Privacy Policy, and any DPA/order form language so the contract matches your internal requirements. Sources: Alysio product page, Alysio Terms of Service, Alysio Privacy Policy

Restrictions, excluded data categories, and benchmarking limitations

"Excluded Data" categories (regulated data warning)

Alysio's Terms of Service instruct customers not to provide data subject to heightened requirements, listing examples including:

GLBA, HIPAA, FERPA, COPPA, and PCI-DSS (and international equivalents). Source: Alysio Terms of Service

Competitor / benchmarking restriction

Alysio's Terms also restrict:

Access by direct competitors (without prior written consent).
Performing or disclosing benchmarking/testing of the service or security environment without prior written consent. Source: Alysio Terms of Service

Procurement checklist

Request documents from the Trust Center
SOC 2 Type 1 (2024) and SOC 2 Type 2 (2025) reports
ZDR certificate (and clarify scope: product modes, Agents, connectors, logs, backups) Source: Alysio Trust Center (Secureframe)
Validate OAuth scope mapping (least privilege)
Review required vs optional scopes (HubSpot/ZoomInfo examples are spelled out)
Confirm Agent write operations (Salesforce/HubSpot) and any safety limits (e.g., delete disabled) Sources: HubSpot integration guide, Salesforce integration guide, ZoomInfo integration guide
Confirm token custody and proxy mediation
Confirm whether OAuth tokens live only in Paragon or also in Alysio systems, and how "encrypted at rest" applies in practice Source: Alysio docs overview
Reconcile ZDR and training expectations
Compare marketing claims vs contractual language
Negotiate contract language where needed (opt-out, retention controls, or no-training commitments) Sources: Alysio product page, Alysio Terms of Service, Alysio Privacy Policy
Check excluded-data fit
Ensure internal policy prevents routing HIPAA/PCI/GLBA/FERPA/COPPA data into the service Source: Alysio Terms of Service

Glossary (sourced)

GTM AI Workspace: Alysio's canonical category — the cross-stack layer that reads across revenue tools via the Context Engine and deploys Agents via Agentic GTM to execute workflows across them.
Context Engine: the intelligence layer of Alysio's Workspace; reads relationships, engagement history, deal progression, and intent across the GTM stack via MCP-powered integrations.
Agentic GTM: the execution layer; deploys named Agents (Deal Execution, AI CRO, Coaching, Customer Retention, Revenue Security, Pipeline and Forecast, CRM Intelligence, Meeting Intelligence) that execute workflow automation across connected systems.
SOC 2 (Trust Services Criteria): A SOC 2 examination reports on controls relevant to security, availability, processing integrity, confidentiality, or privacy. Source: AICPA description of SOC 2
OAuth scopes: Permissions granted to an app during OAuth authorization; in Alysio docs, used to enforce least-privilege Agent operations. Sources: HubSpot integration guide, ZoomInfo integration guide
Least privilege: An access-control principle: grant only the minimum permissions needed for a task. Source: Alysio homepage
ZDR ("Zero Data Retention"): In Alysio's context, a "Zero Data Retention (ZDR) Certificate" is listed as an available Trust Center document. Confirm scope during review.

Alysio security, compliance, and data handling (SOC 2, ZDR, OAuth)