InstaLILY Cloud
Managed hosting in a dedicated cloud project provisioned for your organization. Fastest to deploy.
- HostingGoogle Cloud Platform
- IsolationDedicated GCP project
- RegionsAny region, set per contract
- Operated byInstaLILY
Security
Lily runs inside your systems. Under your controls.
InstaLILY deploys AI agents into the systems your business already runs on: SAP, NetSuite, Epicor, Salesforce, Snowflake. Every customer gets an isolated environment, every agent runs on a scoped identity, and every high-risk action routes to a human before it executes.
Where your data lives
Run it in our cloud, in yours, or in your building.
Some data cannot leave the perimeter. Rather than ask you to make an exception, we deploy where your policy already allows.
Your cloud
Deployment inside your own cloud environment, for teams whose policy requires data to stay in their account.
- HostingCustomer cloud account
- IsolationDedicated instance
- RegionsYour choice
- Operated byJoint
On premises and edge
For regulated or latency-bound environments, including the Small Data Center footprint.
- HostingYour facility
- IsolationPhysical
- RegionsOn site
- Operated byCustomer
On-site deployments run on the Small Data Center. Buyers with a regional obligation should also read European regulatory compliance.
Independent attestation
Audited by a third party, not asserted by us.
Both reports below were issued by an independent accounting firm after testing our controls against published criteria. Full reports are available to customers and prospects under NDA.
SOC 2 Type II
A Type II report tests whether controls actually operated over a full year, not whether they existed on one day. The auditor reported no exceptions across every control tested.
- CriteriaSecurity
- Period23 Feb 2025 to 22 Feb 2026
- AuditorJohanson Group LLP
- Issued1 Apr 2026
- Next reportPeriod began 23 Feb 2026
HIPAA
InstaLILY operates as a business associate, not a covered entity. An independent accountant examined our compliance against the HHS HIPAA Audit Program, covering the Security and Breach Notification protocols, and found our assertion fairly stated.
- ScopeSecurity and Breach Notification
- TypePoint in time
- As of22 Feb 2026
- BAAAvailable
Continuous monitoring
Between audits, control evidence is collected continuously rather than reconstructed at year end. Policies are versioned, owned, and carry scheduled renewal dates.
- GRC platformDrata
- Policy set26 documented policies
- Access reviewAnnual
- Risk assessmentAnnual
Security documentation
Security teams evaluating InstaLILY can request the full package at hello@instalily.ai. We also complete customer security questionnaires.
- SOC 2 Type II report
- HIPAA attestation
- Data processing agreement
- Penetration test summary
- Subprocessor list
- Incident response plan
InstaLILY is not ISO/IEC 27001 certified. For customers subject to GDPR, we act as a processor and execute a data processing agreement on request.
Agent controls
Every agent action passes through the same six gates.
An AI agent that can write to your ERP is a privileged user. We treat it like one. Below is a real quoting action moving through the controls, the same path every action takes, whether a person is watching or not.
Actionquote.reviseRFQ-4821NetSuiteRequested byj.morales
01Identityagent:quote-desk · dedicated svc-account · rbac=least-privilegeVerified
Agents are provisioned with dedicated service accounts under role-based access control and the principle of least privilege. Those service accounts are included in periodic access reviews alongside human accounts, so an agent's permissions are audited the same way an employee's are.
02Permissionscope resolved → 4 objects · tenant=acme · project-isolatedScoped
Every customer runs in a dedicated single-tenant Google Cloud project, so an agent cannot reach another customer's data by design rather than by filter. Within your tenant, agent scope is constrained to the systems and records you connect.
03Input controlsanitize(external) · boundary=ingest · injection guard activeScreened
External data is pre-sanitized and strict data boundaries are enforced at ingestion points, to mitigate prompt injection and adversarial input. A malicious instruction buried in a supplier PDF or an inbound email is treated as data, not as a command.
04Human approvalrule: discount > 20% → require_approval · MATCH (24%) · HELDHeld
High-risk and sensitive operations route to a human intervention workflow before they execute. You define which operations qualify: margin floors, discount thresholds, spend limits, and which records an agent may write to. Because every deployment is built for one business, what counts as high-risk and how an unanswered approval behaves are set during implementation rather than fixed in the product.
05Output controlrate-limit ok · write → NetSuite:Quote/4821 · action loggedExecuted
Agent outputs are rate limited and every action is logged, so there is a record of what the agent did, when, and on whose request.
06Traceabilityprompt@v14 · model@registry · result reproducibleRecorded
Prompts and prompt templates are versioned in a prompt management or version control system, and the model weights we train are managed through a model registry. Any result is back-traceable and reproducible within the tolerance that non-deterministic language models allow.
Data handling
One customer, one project, one boundary.
Most vendors
One database
- tenant_idacme
- tenant_idglobex
- tenant_idinitech
- tenant_idacme
One boundary around everyone. Separation is a value in a column, enforced by application logic.
InstaLILY
instalily-acme
instalily-globex
instalily-initech
A dedicated Google Cloud project each. Separation is a property of the infrastructure, the boundary the provider uses between unrelated companies.
No cross-customer training
Policy-boundNo cross-customer models may be trained. Customer data used for training, fine-tuning, or inference stays inside that customer's single-tenant boundary, and inference outputs are treated as customer-derived information subject to the same isolation. Configuration data is separated the same way.
Encryption
At rest and in transitCustomer data is encrypted at rest with AES-256 using Google Cloud KMS-managed keys, and in transit with TLS 1.3. No network connection used by the platform carries unencrypted data.
Minimal persistence
By designThe platform is built to limit how much customer operational data persists in vendor-managed systems. Where possible, processing runs on ephemeral workers or is offloaded to your own infrastructure.
Retention
180 daysData is retained while your account is active. On voluntary closure it enters an expired state for 180 days, then the account and its data are removed. You can request an export before closing.
Deletion and data subject requests
On requestRequests are raised through your account team or hello@instalily.ai. The platform is not self-service, so these are handled directly rather than through a portal. We hold ourselves to GDPR and CCPA standards and act within the window you need to meet your own statutory deadline.
Staff access
By exceptionProduction data access requires approval and is granted temporarily. Production data is never used in development or test environments, and operator access is subject to access controls and audit logging. Staff with authority to approve that access are in the United States. In many deployments, access to production data sits on the customer side, where we neither grant nor deny it. We process what you connect.
One caveat we would rather state than bury: automated tracing can occasionally capture customer data in application logs. We scrub logs before persistence, log data is stored with defined retention and automatically removed, and this is disclosed in our SOC 2 system description.
Platform & infrastructure
The controls underneath.
Access and network
- Access controlRole-based, least privilege, across all infrastructure.Reviewed annually
- AuthenticationMulti-factor on every system that supports it.Automated lockout
- OffboardingRemoved on termination, tracked in a ticket.Within 3 days
- NetworkCloud Armor web application firewall, VPC isolation.Intrusion detection
Software and testing
- Change managementPeer review, segregation of duties, environments separated from production.AuthorizeDevelopTestDeploy
- Penetration testingIndependent third party, network and application.Annual
- Vulnerability remediationNo release ships with an unresolved critical or high finding without an approved compensating control.High 24hMedium 3dLow 7d
- PersonnelBackground checks, signed code of conduct and confidentiality agreement on hire.Annual training
Resilience and response
What happens when something goes wrong.
1 hourRecovery point objectiveThe most data an incident can cost you
2 hoursRecovery time objectiveThe longest a customer production environment is down
Last recovery pointIncidentService restored
180 daysBackup retention
Managed backups with point-in-time recovery, encrypted with KMS-managed keys. Infrastructure is defined as code, so an environment can be rebuilt rather than repaired.
ZeroIncidents in audit period
No significant security incidents occurred in the services provided to customers during the SOC 2 observation period ending 22 February 2026.
Incident response
A named Head of Security coordinates response, with severity classification, mandatory 24-hour internal reporting, and containment for critical and high incidents. Affected customers are notified directly and without undue delay, in time to support your own regulatory reporting deadlines.
Report a vulnerability
Email hello@instalily.ai. You will get a response within two business days, updates at each stage of review, and credit once the issue is validated and fixed. We do not pursue legal action against good-faith research conducted within scope.
Subprocessors
Who else touches the system.
Every vendor is risk-classified, contractually bound to security requirements, and reviewed annually. We review their audit reports the same way you review ours.
| Provider | Purpose | Location | Scope |
|---|---|---|---|
| Google Cloud Platform | Primary hosting, database, storage, orchestration, WAF, secrets | Per deployment | Customer data |
| Microsoft Azure | Search indexing and supplemental processing | Per deployment | Customer data |
| Model providers | Model inference:   | Per deployment | Customer data |
| Datadog | Monitoring, APM, log aggregation, alerting | United States | Log data |
| Grafana | Monitoring and observability | United States | Log data |
| Drata | Compliance monitoring and control evidence collection | United States | No customer data |
| Vercel | Frontend hosting and delivery | United States | No customer data |
| GitHub | Source control and CI/CD | United States | No customer data |
| Google Workspace | Internal identity, SSO, and MFA for InstaLILY staff | United States | No customer data |
Because the platform is model-agnostic, the inference providers in scope depend on how your deployment is configured, and the enabled set can be expanded or restricted per deployment. Retention with model providers is set by configuration to what your deployment requires, including zero retention where the provider supports it, rather than by a separately negotiated contract term.
Last reviewed February 2026. Reviewed annually and on any material change.
European regulatory compliance
Where we stand in Europe.
Everything specific to European regulation sits in one place, including what we do not hold. The two documents below are the ones a European security review asks for by name.
GDPR
ProcessorGDPR is a regulation, not a certification, so no vendor can be certified against it. You remain the controller and we act as your processor under a data processing agreement. Because Lily can run in your own cloud account or your own facility, personal data can stay in the environment and region your policy already allows, and no customer data trains a cross-customer model.
Data residency
By deploymentDeployments can be placed in any region where the underlying cloud provider offers service, including within the EU. The region is agreed per deployment and written into the contract. Running Lily in your own cloud account or your own facility keeps personal data in the environment your policy already permits, with no transfer to us.
International transfers
None to dateNo EEA personal data has been transferred to us to date, and European deployments are beginning now. Where a transfer becomes necessary, the mechanism is the European Commission's standard contractual clauses, executed as part of the data processing agreement and supported by a transfer impact assessment.
EU AI Act
Corresponding controlsThe six controls in every agent action correspond to what the Act asks of high-risk systems: human oversight before a consequential action executes, record-keeping, traceable inputs, reproducible outputs. That is a correspondence, not a declaration of conformity. We are the provider, you are the deployer, and a standard sales or operations deployment does not fall within Annex III. The full mapping and the timeline are in the EU AI Act overview.
ISO 27001
Not heldNot held and not scoped. Our independent assurance is the SOC 2 Type II report covering the security criteria and the HIPAA attestation, both above.
TISAX
Not heldNot held and not scoped. Raised by some European automotive buyers as a condition of exchanging development data. If you need it, tell us during evaluation.
Breach notification
DirectAffected customers are notified directly and without undue delay, in time to support a controller's own reporting obligation under Article 33.
Common questions
What security teams ask us first.
1Is our data used to train your models, or anyone else's?
No cross-customer models are trained, and any use of your data for training, fine-tuning, or inference stays within your single-tenant boundary. Retention with third-party model providers is set by configuration to what your deployment requires, including zero retention where the provider supports it. We will confirm the exact providers and settings for your deployment during security review.
2Can an agent take an action nobody approved?
Only where you have decided it should. High-risk and sensitive operations route through a human intervention workflow before executing, and which operations qualify is configured during implementation rather than fixed in the product. Every agent action is logged whichever path it takes.
3How is our data separated from other customers'?
At the cloud project level. Each customer gets a dedicated Google Cloud project rather than a shared database with a tenant column, so isolation is a property of the infrastructure rather than of application logic.
4Can InstaLILY employees see our data?
Production data access requires approval and is granted temporarily, never standing. Access is subject to audit logging, and production data is never copied into development or test environments. Staff with authority to approve that access are in the United States. In many deployments, production data access sits on the customer side, where we neither grant nor deny it.
5Have you had a security incident?
No significant incidents occurred during the SOC 2 observation period from 23 February 2025 to 22 February 2026, and none have occurred since. The auditor tested our incident response controls and noted no exceptions.
6Are you ISO 27001 certified?
No, and it has not been scoped. We hold a SOC 2 Type II report covering the security criteria and an independent HIPAA attestation. If ISO 27001 is a requirement for your organization, tell us during evaluation.
7How do we get your SOC 2 report?
Email hello@instalily.ai. We will share the current report under NDA, along with the HIPAA attestation, penetration test summary, and subprocessor list.