Security

1. Overview

Lingo holds two kinds of customer data: the technical documentation and guides a manufacturer provides, and the conversations installers have with that manufacturer’s support service.

Lingo is a cloud service shared by its customers. Each customer’s documentation, guides, conversations, images and settings are logically isolated and tied to that customer, so that one customer cannot reach another’s data. A dedicated deployment for a single customer can be discussed where one is needed.

2. Where data is hosted

Customer data is hosted with Amazon Web Services in Ireland (the eu-west-1 region). Messages are carried over the WhatsApp Business Platform through Twilio.

3. Encryption

All data in transit is encrypted with TLS 1.2 or higher, including the connections to our messaging and model providers.

All data at rest, including databases, file storage and backups, is encrypted using AES-256.

4. Who can access customer data

Access to live systems is limited to named Lingo staff, requires multi-factor authentication and is logged. Authorised staff may view conversations only to give support, to investigate an incident and to help the manufacturer improve its own guides.

Within your own account, each person has their own login with multi-factor authentication, and roles control who can view conversations, edit guides and publish them.

A support service can be limited to a list of known phone numbers, and numbers can be blocked.

5. How your documentation is used

Your documentation is used to build your guides and to answer your installers. Answers come from guides your own technical team has reviewed and published. The assistant is instructed not to answer from outside them, and to pass the conversation to your team when it cannot help.

Language models are used to understand the installer’s question and to phrase the reply. The substance of the answer always comes from your published guides.

6. AI models and your data

Your data is never used to train or fine-tune an AI model, by Lingo or by the model providers we use, whose terms prohibit training on the data sent to them.

The text of a question and its answer is sent to a model provider only for as long as it takes to produce the reply. Our routing provider is set not to retain it.

Your conversations are not used to improve any other customer’s service or any other Lingo product.

7. Suppliers that process customer data

These suppliers process customer data for Lingo. None receives more than it needs for its role, and Lingo remains responsible to its customers for each of them.

8. Retention and deletion

Conversations and images are kept for the length of the manufacturer’s contract, so that the manufacturer can review them. A manufacturer can ask for particular conversations or particular users to be deleted at any time.

When a contract ends, the manufacturer’s data is deleted within 30 days, and backups age out within 35 days of that deletion. The search indexes and usage figures derived from the data are deleted with it. We confirm deletion in writing on request.

9. Availability

We aim for the service to be available for 99.5% of each month, not counting maintenance announced in advance or outages of WhatsApp, Meta or Twilio.

WhatsApp holds a message that arrives while the service is unavailable and delivers it when service resumes, so nothing is lost. If the assistant cannot reply within three minutes, the conversation is passed to the manufacturer’s own team and the installer is told.

10. Incidents

If we become aware of a breach of security affecting your data, we will tell you without undue delay, with what we know and what we are doing about it.

11. New features

New features are reviewed against our AI risk assessment and tested on representative conversations before release. They can be switched on for one customer at a time, and we tell customers in advance about any material change to how their data is processed, including a new supplier.

12. Compliance

Lingo Ltd is registered in Northern Ireland and processes personal data under the UK GDPR and the Data Protection Act 2018. Our data processing agreement forms part of every customer contract.

13. Reporting a vulnerability

If you believe you have found a security problem in Lingo, tell us at paul dot wilsdon at golingo.ai. Please give us a reasonable time to fix it before making it public. We will not take action against anyone who reports a problem in good faith.