Security, in detail.
WALLIOO sits in the path of sensitive interactions between your people, your agents and AI. It is built to be the most trustworthy component in that path — here is how.
A clear security boundary
WALLIOO enforces policy wherever one of its control points is deployed: Browser Guard in the browser, and Gateway on the traffic you route through it. It does not claim to observe what it cannot see — which makes the boundary explicit, testable and auditable.
Browser Guard: protected before it leaves
Employee text is analyzed in the browser, before anything is sent. Sensitive values are replaced with codes, and the real values are restored when the answer arrives. The AI provider only ever receives codes; real values travel only inside WALLIOO, encrypted, and are never stored on WALLIOO’s servers.
Documents attached through the WALLIOO panel are sent over an encrypted connection to the document service in your WALLIOO environment, processed in memory, and returned anonymized. Files are not stored.
Gateway: least privilege for agents
- Identity on every call — each request is tied to a user, agent or application through your identity provider.
- Credentials stay with WALLIOO — agents never hold the keys to ServiceNow, Salesforce or your APIs; the Gateway does, scoped to what the policy allows.
- Payloads in transit, not at rest — requests and responses are inspected and transformed in memory and not stored by default.
- Humans in the loop — high-impact actions wait for an explicit approval.
Your environment, your choice
Every customer runs in its own isolated WALLIOO environment, never shared with another organization. We can host it for you on a leading cloud provider, or deploy it inside your own cloud account or data center so that nothing leaves your perimeter. Connections to WALLIOO are encrypted with TLS, secrets such as enrollment PINs and keys are encrypted at rest, and administrator sessions expire on both inactivity and an absolute limit.
Audit without a new data store
WALLIOO records metadata about each decision — who, which AI or tool, which rule, what outcome — never the text of a message, the response or the masked values. Security events are kept for 90 days by default, and person-level detail can be switched off.
Detection you can rely on
WALLIOO detects personal data with its own AI model, developed and trained in-house for English and Spanish. Benchmarked against the AI4Privacy PII-detection dataset, it reaches 99.5% accuracy.
On top of the model, your own rules — client names, project codenames, account formats — are matched deterministically. And every policy rule, for people or agents, is applied exactly as configured and recorded in the audit trail.
Our principles
- Data minimization — collect and keep only what control and audit require.
- Customer control — storage, logging and deployment choices are visible and configurable.
- Least privilege — agents and integrations get only the permissions their use case needs.
- Policy transparency — security teams can always see why a decision was made.
Go deeper
We are happy to walk your security team through the architecture, answer your security questionnaire, or run a proof of concept inside your own environment. Talk to us →