< Security, privacy and compliance >

How Aivar protects the work customers trust us with

Aivar designs and builds agentic AI systems for customers in regulated industries. This Trust Center is the authoritative source for how we safeguard customer data, which controls have been independently audited, and how to request the underlying reports and certifications.

Request report

See our controls

LAST UPDATE: 08 OCTOBER, 2026

REVIEWED BY THE AIVAR SECURITY TEAM

< Compliance >

Independently certified and attested

ISO/IEC 27001:2022

Information Security Management System

The ISMS covers all information assets and supporting systems owned, operated or managed by Aivar, across IT, HR, Finance, Facility, Marketing, Development and Sales. No exclusions from the standard.

Certification Body:

InterCert Inc. (The Woodlands, Texas)

Registration No:

17 June 2025

Current Certificate:

Rev. 1 · issued 17 June 2026

Surveillance Validity:

16 June 2027

Recertification Due:

16 June 2028

Latest Audit:

Surveillance Audit I · 8–10 June 2026 · 0 non-conformities

Request certificate

HIDE CERTIFICATE DETAILS

SOC 2 Type 2

AICPA Trust Services Criteria

A CPA firm examined the design and operating effectiveness of controls over the Aivar Processing System for a full twelve-month period. Every control tested operated effectively with no exceptions.

Service Auditor:

Atom Assurances LLC, CPA firm (Wyoming licence no. 1192)

Observation Period:

14 June 2025 – 13 June 2026

Report Issued:

16 September 2026

Criteria:

Security · Availability · Processing Integrity · Confidentiality · Privacy

Controls Tested:

73 · 0 exceptions

Incidents Disclosed:

None during the period

Request certificate

HIDE CERTIFICATE DETAILS

IN PROGRESS [COMING SOON]

ISO/IEC 27701

Privacy Information Management System

ISO/IEC 42001

AI Management System

HIPAA

Health data safeguards for US healthcare customers

GDPR

EU data protectionalignment

< Resources >

Reports and documents

NOTE: Audit reports and policies are shared with customers, prospects and their assessors on request, and most requests are answered within two business days. Reports marked ‘NDA’ are provided once a Non-Disclosure Agreement is in place.

REPORTS

SOC 2 Type 2 report

Atom Assurances LLC · Independent service auditor's report with control test results · June 2025 – June 2026

Request Access

ISO/IEC 27001:2022 certificate

InterCert · Certificate (Rev. 1) with scope statement and registration number · June 2026

Request Access

ISO 27001 surveillance audit report

InterCert · Surveillance Audit I report with findings · June 2026

Request Access

SECURITY QUESTIONNAIRES

Security questionnaire support

We complete customer questionnaires (SIG, CAIQ or your own template) and can pre-fill from our SOC 2 evidence

Request Access

< controls >

How the programme works in practice

Access control

Role-based access on the principle of least privilege, governed by an access matrix

Multi-factor authentication required for cloud services and remote access

Quarterly access reviews by the Information Security Officer

Access revoked within three business days of an employee leaving

Production root-account use logged with alerting; admin access limited to named administrators

Privileged credentials held in a password vault, not shared directly

Infrastructure & network

Hosted on AWS inside a virtual private cloud with deny-by-default security groups

Front-end firewalls at the perimeter; back-end firewalls isolate databases from internal traffic

Network segmented by data classification level

Intrusion detection and firewall alerts reviewed and tracked to closure

Monthly vulnerability scans with risk-ranked remediation

AWS SOC 2 report reviewed annually for physical and environmental controls

Data protection

Data in transit encrypted with TLS using certificates from an established CA

Data at rest encrypted with AES-256

All customer data classified Customer Confidential, the highest tier

Customer content and personal data never used in non-production environments

Data retained per contract and regulation; disposed of on request with written confirmation

Reports delivered externally only over encrypted channels

Secure development

All changes through version control with feature branches and pull requests

Mandatory peer review; reviewer must differ from the author

Automated testing before release; full change history supports rollback

Production deploy rights restricted to those who need them

Secure coding standards with input validation and error checking; findings tracked to resolution

Endpoints & people

Background checks for every new hire

Policy and confidentiality acknowledgements at hire and annually

Security awareness training at onboarding and every year

Managed devices with disk encryption, EDR, anti-malware and automatic patching

Screens lock after five minutes of inactivity; email attachments scanned at the gateway

Incidents, continuity & governance

Documented incident response with severity ratings, escalation and customer notification

Post-mortems for every critical-severity incident

Business continuity and disaster recovery plan with defined RTO/RPO, tested annually

Backups at least daily; restores tested at least annually

Annual risk assessment and vendor risk review, reported to senior management

Named Information Security Officer accountable for the programme

< Frequently Asked Questions >

Got questions? We’ve got answers

Can we get a copy of the SOC 2 report?

Yes. Use any “Request access” button on this page. The report is restricted-use under AICPA standards, so we share it with current and prospective customers and their assessors after an NDA is signed. Most requests are fulfilled within two business days.

Which Trust Services Criteria does the SOC 2 cover?

All five: Security, Availability, Processing Integrity, Confidentiality and Privacy. The observation period was 14 June 2025 to 13 June 2026, and the auditor noted no exceptions across the 73 controls tested.

Is the ISO 27001 certificate publicly verifiable?

Yes. The certificate is registered with InterCert under number IC-IS-2506258 and can be checked on InterCert's verification portal or on IAF CertSearch.

Is our data used to train AI models?

No. Customer data is classified Customer Confidential and used only for the purposes stated in the engagement agreement. It is never used in non-production environments, and model providers are engaged under terms that exclude training on customer content.

How do you handle a security incident that affects us?

Incidents are triaged against a severity scale, escalated to the security team and senior management, and affected customers are notified through the contacts agreed at onboarding. Critical incidents receive a post-mortem. No reportable incidents occurred during the latest SOC 2 period.

Can our workloads be hosted anywhere globally?

Yes, customer workloads can be hosted in another AWS region where a customer requires it.

Will you complete our security questionnaire?

Yes. Send it through the request form or to the security team and we will return it, pre-filled from our audited evidence where possible.

Talk to the security team

Have a question about our programme? Found a vulnerability you want to report? Looking for something these documents don’t cover?We reply to every message within two business days.

Contact the security team