Built to be trusted. By your security team, and by the machines.
CLEO connects to your CMS, your search and analytics, audits and publishes content, and tracks how AI engines cite your brand. That means we hold access, and we take it seriously.
Here is how we protect your data. What is established, and what we are still strengthening. We would rather you see both.
01.
IDENTITY & ACCESS
A verified core
Delegated identity, no passwords: all sign-in is handled by a specialist identity provider using signed, verified tokens. CLEO stores no passwords of its own.
Encrypted credentials. The credentials we need to publish on your behalf are encrypted at the application layer using authenticated encryption and a strong key-derivation function. If our keys are absent, the service fails closed.
Controlled egress. Every response passes through a multi-pass scrubber that strips internal detail and personal data before anything leaves our service, with an automated guard that prevents regressions.
Tenant isolation. Your data is isolated per project. The acting identity is always taken from a verified token, never from the request itself, and every read and write is scoped to your own projects.
Isolated hosting: CLEO runs in a dedicated cloud account. Production and staging are fully separated. Billing is handled by a PCI-certified provider; we never store card data.
02.
ENCRYPTION
Protected in transit, at rest, and at field level
In transit: a modern minimum TLS version, with a full set of browser security headers: strict transport, content-security policy, frame and content-type protections.
At rest: encryption across all managed data stores at the cloud-platform layer; provider attestations available on request.
At field level: sensitive credentials encrypted in the application with authenticated symmetric encryption and an iterated key-derivation function.
03.
AI & YOUR DATA
Your content stays yours
Your content is never used to train third-party AI models. We use AI providers only on their paid, commercial API terms, under which client inputs and outputs are not used to train their models. We do not use free tiers that would permit it.
We do not train our models on your campaigns. If that ever changes, it will be strictly opt-in: you will be asked first, and you may decline and continue to use CLEO in full.
Your CMS credentials never leave for AI or search vendors. Only the marketing and content data required for a task is sent to generate or analyse content.
The global core of g. g has two layers. Your layer holds the facts about your business and is read only by your own proposals. The global core holds findings: generalised rules with evidence, learned across the sites CLEO runs. Only a pattern identifier, segment labels and numeric outcomes ever enter the core, never a fact, page, prompt, review, person or client identifier, and a finding is written only when at least five sites back it. The only write path into the core is a promotion reviewed by a person at CLEO. Opt out of contributing in Settings; opted-out sites still read the core in full.
04.
EXCLUSIONS
What we never hold
Payment-card data: card handling is delegated entirely to a PCI-certified provider.
Passwords for your users: identity is delegated.
Clinical records, patient files, or claims data: CLEO works with marketing data and is not a system of record for any such data.
05.
HOSTING
Hosting and data residency
CLEO is hosted in Mumbai, with disaster recovery in New York. Operational telemetry is processed in-region. Automated backups and point-in-time recovery are in place, with a web application firewall at the edge and container image scanning on every deployment.
06.
ASSURANCE
Where we stand, plainly
CLEO has completed an internal SOC 2 Type 1 readiness assessment across all five Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity, and Privacy. We are not yet independently audited: no external firm has issued an opinion. We state this plainly, because a security team is best served by a vendor that knows exactly where its strengths and boundaries are.
Subprocessors are bound by data-processing agreements. The named subprocessor list is published on the Legal page, with their regions and current attestations.
07.
FOR REVIEWERS
Request the full overview
A full Security & Trust Overview, architecture and data-flow, control matrix, data inventory, subprocessor list, data-processing agreements, and our control enhancement plan, is available under controlled review. We are glad to host a technical walkthrough with your team and to complete any security questionnaire your process requires.
We would rather you see the full picture than a polished summary. That is the posture.
Security
CLEO Security & Trust. Built to be trusted. By your security team, and by the machines.
CLEO connects to your CMS, your search and analytics, audits and publishes content, and tracks how AI engines cite your brand. That means we hold access, and we take it seriously. Here is how we protect your data: what is established, and what we are still strengthening. We would rather you see both.
A verified core
Delegated identity, no passwords: all sign-in is handled by a specialist identity provider using signed, verified tokens. CLEO stores no passwords of its own. Encrypted credentials. The credentials we need to publish on your behalf are encrypted at the application layer using authenticated encryption and a strong key-derivation function. If our keys are absent, the service fails closed. Controlled egress. Every response passes through a multi-pass scrubber that strips internal detail and personal data before anything leaves our service. Tenant isolation. Your data is isolated per project. Isolated hosting: CLEO runs in a dedicated cloud account with production and staging fully separated.
Encryption at every layer
In transit via modern TLS with full browser security headers. At rest across all managed data stores. At field level with authenticated symmetric encryption.
AI and your data
Your content is never used to train third-party AI models. We use AI providers only on their paid, commercial API terms. We do not train our models on your campaigns. If that ever changes, it will be strictly opt-in. Your CMS credentials never leave for AI or search vendors.
The global core of g. g has two layers. Your layer holds the facts about your business and is read only by your own proposals. The global core holds findings: generalised rules with evidence, learned across the sites CLEO runs. Only a pattern identifier, segment labels and numeric outcomes ever enter the core, never a fact, page, prompt, review, person or client identifier, and a finding is written only when at least five sites back it. The only write path into the core is a promotion reviewed by a person at CLEO. Opt out of contributing in Settings; opted-out sites still read the core in full.
What we never hold
Payment-card data, passwords for your users, clinical records or patient files.
Hosting and data residency
CLEO is hosted in Mumbai, with disaster recovery in New York.
Assurance posture
CLEO has completed an internal SOC 2 Type 1 readiness assessment across all five Trust Services Criteria. We are not yet independently audited. Subprocessors are bound by data-processing agreements. The named subprocessor list is published at regencleo.ai/legal/#sub-processors, with their regions and current attestations.
Contact
contact@regencleo.ai
A verified core
Encryption at every layer
AI and your data
What we never hold
Hosting and data residency
Assurance posture
Contact
Frequently asked questions
Does CLEO store my password?
No. All sign-in is handled by a specialist identity provider using signed, verified tokens, and CLEO stores no passwords of its own.
How are the credentials CLEO needs to publish protected?
They are encrypted at the application layer using authenticated encryption and a strong key-derivation function. If our keys are absent, the service fails closed.
Is my data isolated from other customers?
Yes. Data is isolated per project, and CLEO runs in a dedicated cloud account with production and staging fully separated.
Is my content used to train AI models?
No. Your content is never used to train third-party AI models. We use AI providers only on their paid, commercial API terms, and we do not train our models on your campaigns. If that ever changes it will be strictly opt-in. Your CMS credentials never leave for AI or search vendors.
What data does CLEO never hold?
Payment-card data, passwords for your users, and clinical records or patient files.
Where is my data hosted?
CLEO is hosted in Mumbai, with disaster recovery in New York.
Is CLEO SOC 2 certified?
Not yet. CLEO has completed an internal SOC 2 Type 1 readiness assessment across all five Trust Services Criteria, but is not yet independently audited. Subprocessors are bound by data-processing agreements.
About CLEO by RegenAI
CLEO by RegenAI is the Presence Growth Engine: interconnected marketing that runs itself. CLEO runs a brand's Maps, Search, AI Search, Social, Reviews and Leads from one centre, g, so every channel makes the others stronger. In Orbit, its autonomous mode, CLEO finds the work, does it and brings it to one approval queue. Every action is logged with its before and after, and any applied fix reverses in one click. CLEO created the Presence Growth category and, on 18 September 2026, became the world's first engine to run a brand's entire presence autonomously, under approval. Evidence at regencleo.ai/worlds-first, and a free scan at regencleo.ai/scan.
