Trust Center
Built for the standards finance lives by.
Security, privacy, and auditability are not features we added — they are how the platform is built. Here is what your audit, security, and procurement teams need.
Compliance
Frameworks we are aligned to or pursuing.
We disclose status honestly. "Aligned" means controls are implemented; "In progress" means certification is underway with a target date we share under NDA.
SOC 2
In progress
Independent audit of security, availability, and confidentiality controls.
GDPR
Aligned
EU data protection — DPA available; sub-processors disclosed.
ISO 27001
In progress
Information security management system aligned to ISO 27001 controls.
AICPA
Aligned
Controls structured for service-organization audits relied on by your auditors.
How we are different
The architecture, not the checkbox.
Read-only, org-scoped queries
Every query runs in a read-only transaction, with statement timeouts and your organization id injected at the database layer. There is no path to writes; there is no path to other tenants.
Auditable AI outputs
Every agent answer captures the queries it ran, the rows it touched, and the reasoning it produced — exportable for audit walkthroughs.
Enterprise-grade by default
SAML SSO, custom-claim RBAC, IP allow-listing, and audit logs are not paid add-ons. They are how Quivv is built.
Controls
What is in place today.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest. Customer-managed encryption keys (CMEK) available on enterprise plans.
Identity and access
SAML 2.0 SSO, SCIM provisioning, role-based access control with custom claims, IP allow-listing, and session-bound MFA.
Data residency
Primary data is hosted in the EU (europe-west1 / europe-north2). Customer data does not leave the region without explicit opt-in.
Tenant isolation
Row-level org_id scoping enforced server-side at the database layer. There is no client-side path to data outside your tenant.
Audit logs
Every access request, approval, entitlement change, ingestion, and AI output is captured in an immutable audit trail, exportable on demand.
Vulnerability management
Dependencies scanned on every commit. Critical CVEs are patched on the same business day; medium severity within seven days.
Sub-processors
Who we work with to deliver Quivv.
Each sub-processor below is bound by a written DPA. We notify customers before adding new sub-processors that handle customer data.
| Sub-processor | Purpose | Region |
|---|---|---|
| Google Cloud Platform | Hosting, compute, storage | EU (multi-region) |
| Cloudflare | CDN, DDoS protection | Global |
| Anthropic | LLM inference (Claude) | US |
| OpenAI | LLM inference (fallback) | US |
| Sentry | Application error monitoring | EU |
| PostHog | Product analytics | US |
Need more for your security review?
We can share our SOC 2 progress letter, penetration test summary, and architecture diagrams under NDA.