Security and data
Your information, your data, your control
OyeIA operates under clear principles: data on Peruvian hosting, Law 29733 compliance, exportability without lock-in, detailed audit logs, documented continuity plan.
Law 29733 compliance (Personal Data Protection)
We process personal data only for explicit contracted purposes, keep an internal processing record, manage ARCO rights (access, rectification, cancellation, opposition) under documented request, and notify the data subject when applicable. We provide a designated DPO for companies that require it as part of the Corporativo SLA.
Peruvian hosting and local latency
VPS instances on Profesional, Empresa and Corporativo tiers live with providers that have a LATAM presence (Vultr Lima, AWS São Paulo or regional equivalent of your choice). This reduces bot response latency, simplifies compliance, and enables in-country auditing.
Data exportability — no lock-in
Your data always belongs to you. At any time you can request a full export: conversations, contacts, metrics, configurations. JSON format + SQL dump of the client's Postgres. No penalties, no red tape. If you decide to leave OyeIA, we hand everything over in under 5 business days.
Audit logs and traceability
On Empresa and Corporativo tiers, we log every CRM change, every bot reply, every human handoff, every configuration change with timestamp, user and diff. Logs retained for 12 months (Empresa) or 36 months (Corporativo). Available via Metabase queries or export on request.
Encryption in transit and at rest
All communication over HTTPS/TLS 1.3. Postgres with at-rest encryption, keys managed by the hosting provider. WhatsApp via self-hosted Evolution API respects Meta's end-to-end model for messages. Encrypted geo-replicated backups (Corporativo tier).
Continuity and recovery plan (Corporativo)
For Corporativo tier clients, we offer a DR plan with RTO ≤ 4 hours and RPO ≤ 1 hour. Geo-replicated backup, documented recovery runbook, semiannual drill. External audit available under NDA for companies that need to verify it.