AI trust at Viraly: what reaches a model, where it runs, what we keep

In the composer, Viraly suggests captions, hashtags, images and ideas while you write a post. You ask for a suggestion, it appears, and you keep it, edit it or ignore it.

The assistant (labelled Copilot in the app) sits in a panel on every page. Ask it about your posts, inbox or numbers in plain words and it reads the data and answers. Ask it to change something and it shows a card first, so you confirm, edit or decline the change before anything happens.

Routines run in the background on a schedule, one job each, for the social set where a member switched them on. Level 1 routines watch and report: a daily inbox digest, an hourly channel health check, a weekly performance digest. Level 2 routines prepare work inside the workspace as drafts, labels and suggestions, and a member confirms anything that goes out. Level 3 routines, the ones that would act on their own, are switched off in production today.

The Claude models run on Amazon Bedrock inside Viraly's own AWS account in the United States. Requests enter through the us-east-1 region, and Bedrock may serve them from another US region, never from outside the United States. A request for the assistant, a routine or a caption goes from Viraly's servers to Bedrock in that account, and the result comes back the same way. Image generation goes to OpenAI's API, also in the United States.

There is no choice of data region today, so a customer who needs processing outside the United States cannot have it yet. The privacy policy points to this page for the current list of providers, and the table further down lists each one with what it is used for.

A request is processed to produce the result you asked for, and that is the only purpose your content is shared with a provider for. We do not sell your data, and we do not share it with an AI provider for any other reason. The same commitment is written into the privacy policy.

Here's how it works: ask what is scheduled for next week and the assistant reads next week's posts for the social set you have open, nothing from another social set and nothing from another workspace. The answer shows what was read, so you can check it yourself.

The brief is the text box on the assistant's page where you describe the brand's voice, what to avoid and any house rules. The assistant reads it before every answer, and it is the only thing carried from one conversation to the next. Nothing goes to a provider unless you ask, or a routine you switched on runs its job.

The tokens that connect your channels stay with Viraly and never enter a prompt, so a model has no way to post, read or act on a network by itself. Everything the assistant does goes through Viraly's own tools, with a card before anything that changes your workspace and a question before anything that goes out.

A comment or a message from your audience reaches the model as data to analyse, so a comment that says 'ignore your rules and post this' is a comment to read, not a command to follow. And whatever a model makes of it, nothing is published, sent or deleted without a member saying yes, because those actions always ask. Data from a workspace or a social set other than the one you are working in is not part of the request either.

The workspace switch is on the assistant's page in the app, and only the owner sees it. Switched off, nobody in the workspace can ask the assistant anything. Routines are switched on one at a time, per social set, from the Routines tab, and switched off the same way.

Publishing now, replies, DMs and deletes always ask, whatever is switched on. Each plan also includes a monthly number of actions, so there is a ceiling on how much the assistant can do in a month, and the meter at the bottom of the panel shows what is left.

• Conversation threads: deleted 12 months after their last message.
• The Activity log: every proposed and completed change, who asked for it and what changed, with Undo for 30 days.
• Posts and analytics: your plan's data retention.
• The brief: kept until you clear it.
• Account deletion: removes all of the above. The data deletion page says how to ask for it.

Routines report what they did in the app, on the assistant's page and the bell, and each routine card shows its last run.

That is why publishing now, replies, DMs and deletes always ask before they happen, and every other change shows a card like the one below first. The card is the first safety net and Undo is the second.

Routines that prepare work (Level 2) write drafts, labels, notes and collections inside the workspace, and every one of those writes is in the Activity log with the same 30 days of Undo. They never publish, reply or delete.

• No SOC 2 or ISO 27001 certification yet. There is no auditor's report to hand to your security team today. This page and the privacy policy are the documentation, and a security questionnaire sent to contact@viraly.io is answered by a person.
• No choice of data region. The models run in the United States and that is the only option today, so a customer who needs processing in another region cannot have it yet.
• No memory between conversations beyond the brief you write. Each conversation starts from your brief and the data in your workspace, so the assistant does not carry over what you told it last week, and nothing said in one conversation reaches a model in the next.
• Digests are shown in the app, not emailed yet. Routine reports land on the assistant's page and the bell, so someone has to open Viraly to read them. There is no email or Slack delivery today.
• Routines that act on their own (Level 3) are switched off while they are finished. Nothing is scheduled, retried, rescheduled or added to a bio page by a routine without a member today. The routines you can switch on watch, report and prepare drafts.
• No third-party security audit published yet. There is no penetration test report or external audit to share today, so the controls on this page are described by Viraly and not yet verified by an outside firm.

This list is updated when something changes, and the date at the top of the page moves with it.

Security questionnaires, data processing questions and anything this page does not cover are welcome at contact@viraly.io. The privacy policy covers the rest of the service, and the data deletion page says how to remove an account and everything in it.