Built for data that is itself controlled.
What you upload to Thylon — datasheets, specs, drawings — is often controlled technical data under the very rules we help you follow. So the security page isn’t boilerplate here; it is the product keeping its own promise.
What your security review will find.
EU-hosted
Your data lives on EU infrastructure, in a named region, under EU jurisdiction. Nothing is processed outside it.
Tenant isolation
Each customer’s data is isolated at the architecture level — no shared stores, no cross-tenant queries.
Encrypted everywhere
In transit and at rest, end to end — with a customer-managed-keys option for customers who need the keys in their own hands.
Access on the record
Role-based access and a full audit log of every read and write — the same discipline the product applies to your determinations.
Never training data
Your documents are never used to train models. Not anonymised, not aggregated, not ever.
Certifications, honestly
ISO 27001 and SOC 2: in progress — we state audit status plainly rather than borrowing badges. BSI C5 is on the roadmap for German public-adjacent buyers.
Storing ITAR and EAR technical data, lawfully.
Since 25 March 2020, unclassified ITAR technical data secured with end-to-end encryption is not treated as an “export” when transmitted or stored abroad (ITAR §120.54), mirroring the EAR’s §734.18 carve-out in force since 2016. Thylon’s architecture is engineered to those conditions:
Encrypted before it moves
Data is encrypted end to end — before it leaves you and at every boundary — to FIPS-validated or equivalent ≥128-bit standards.
Keys stay out of third hands
Decryption keys are never provided to third parties — including the cloud provider. Customer-managed keys put them in yours.
No proscribed destinations
Storage and processing locations exclude proscribed countries, by architecture, not by policy memo.
Designed for the carve-out
The intent is simple: hosting your technical data with Thylon should not itself be an export event. Verify the fit for your programme with your counsel — we’ll walk them through the architecture.
A sharper threat model, answered directly.
Taiwanese defence and drone suppliers are priority intelligence targets and the builders of the non-red supply chain. Their questions deserve direct answers.
Non-red by construction
No PRC-owned or PRC-operated infrastructure, software or subprocessors anywhere in the stack. Stated as a pledge, held as an architecture rule.
Neutral ground
Data hosted in the EU — outside PRC jurisdiction. For customers weighing US jurisdiction questions, customer-managed keys keep the decryption capability in Taiwan.
Your regime, first-class
Taiwan’s SHTC export-permit workflows and the fast-moving MOEA entity list are built into the product — alongside the US re-export rules that follow American components in Taiwanese hardware.
Credibility that travels
Compliance run on a European platform is itself a sales argument with EU and US buyers — and it aligns with Taiwan’s own drone-cybersecurity certification push. Traditional Chinese UI and support: on the roadmap, stated honestly.
Questions, answered straight.
Where exactly is our data?
On EU infrastructure in a named region, disclosed in the order documentation along with the full subprocessor list. It is processed nowhere else.
Who at Thylon can access it?
Access is role-based, minimal and logged — every read and write lands on an audit trail you can request. We answer this question with a mechanism, not an adjective.
Do you train models on our documents?
No. Absolutely not — not anonymised, not aggregated. Your technical data is used to serve you and for nothing else.
Can we bring our own keys?
Yes — customer-managed keys are available for customers whose threat model or counsel requires the decryption capability to stay in their hands.
Can we store ITAR technical data with you?
The architecture is engineered to the ITAR §120.54 and EAR §734.18 end-to-end encryption conditions, which treat properly encrypted unclassified technical data as not exported when stored abroad. Bring your counsel — we’ll walk them through it.
Is any part of your stack PRC-origin?
No. No PRC-owned or PRC-operated infrastructure, software or subprocessors — anywhere. That is the non-red pledge, and it is auditable.
Your datasheets are controlled data. We built for that.
Thylon is live with its launch cohort — the next seats open by application. Tell us what you’re shipping.
Launch cohort full · applications reviewed in the order received