Security
Your customers' data. Locked down.
Encrypted everywhere. Audited annually. SOC 2 in progress. Built for enterprise diligence teams.
In progress
Compliant
Self-attested
Compliant
How we secure your data
Three layers. Always on.
Encryption in transit, at rest, and in use. Regional isolation by default. Tight access controls on everyone, including us.
Encrypted everywhere. All the time.
Your customer data is encrypted from the moment it leaves the customer's device until it lands in our database — and stays encrypted while it sits there. TLS 1.3 in transit, AES-256 at rest, no exceptions.
Even backups are encrypted. Even our internal team's read-only access goes through encrypted, audited tunnels with session-bound credentials.
Your data stays where you choose.
Three regions, each fully isolated. EU customer data lives in Frankfurt and never leaves. India data stays in Mumbai. US data stays in Virginia. Cross-region transfers are governed by Standard Contractual Clauses only when explicitly required.
Enterprise customers can request a dedicated single-tenant region — a fully isolated deployment with its own database, its own keys, its own DNS.
Tight controls. Including on us.
Our own team has the least possible access to your customer data. Production access requires SSO + 2FA + role-based grant + a signed audit log entry. “I needed to debug something” is not a sufficient reason.
For your team: SSO, SAML, SCIM, role-based access control, full audit log, granular permissions. Standard enterprise IAM stack — and we don't charge extra for SSO.
Security specifications
The numbers your security team wants.
Specific commitments. Verifiable. Available in our SOC 2 report and the DPA.
What we don't do
The never list.
Specific commitments, not aspirational ones. If we ever change one, we'll tell every customer 90 days in advance.
Trust documents
Read the paperwork.
Public documents anyone can read. Confidential documents (SOC 2, pentest reports) available under NDA on request.
Privacy Policy
What we collect, how we use it, your rights as a data subject. Plain English, ten sections.
Read ›Data Processing Addendum
Standard DPA with SCCs for EU transfers. Auto-included for Enterprise. Sign-able PDF available.
Read ›GDPR Compliance
Article-by-article compliance details. Includes Article 27 EU representative info.
Read ›Sub-processors list
Every third-party we share data with, what they receive, where they're located. Updated continuously.
Read ›SOC 2 report
Type II audit in progress (target Q3 2026). Type I report available now under NDA. Email to request.
Request ›Pentest summary
Latest annual pentest executive summary. Available under NDA. Findings remediated within 30 days.
Request ›Direct line
Talk to our security team.
Real humans. Real responses. No tickets, no chatbots — for security questions, you reach us directly.
Email security@aivachat.io
For security questionnaires, vendor reviews, custom DPA negotiation, or anything else security-adjacent. Our DPO is Priya Sharma. Disclosure of vulnerabilities (responsible disclosure) goes to the same address — please include “[VULN]” in the subject.
Diligence done. Try it free.
Free for 14 days. No credit card. Custom security reviews available for Enterprise prospects.