Security & Compliance

Data Encryption, Storage, and Retention Policies

AIVRA utilizes industry-leading encryption standards to protect customer data both in transit and at rest.

Encryption Standards:

• Data in Transit: All communication uses TLS 1.2 or higher.
• Data at Rest: Customer data is encrypted using AES-256 encryption within our cloud infrastructure.
• Key Management: Encryption keys are managed through a secured, rotating cloud KMS service.

Data Retention:

We retain workflow logs and audit trails for a minimum of 90 days, or for the duration specified by your enterprise contract. Upon account termination, all customer data is purged after a 90-day grace period.

Regulatory Compliance and Certifications (GDPR, SOC 2, HIPAA)

AIVRA is committed to global compliance standards, ensuring our platform is suitable for use across regulated industries.

Key Compliance Areas:

• GDPR (General Data Protection Regulation): We are a GDPR-compliant data processor. Our platform includes tools for data subject access requests and the right to erasure.
• SOC 2 Type II: AIVRA undergoes annual SOC 2 Type II audits covering the trust principles of security, availability, and confidentiality. The latest report is available upon request for enterprise customers.
• HIPAA: While the platform is designed to support HIPAA compliance, customers processing Protected Health Information (PHI) must execute a Business Associate Agreement (BAA) with AIVRA.

Reporting Security Vulnerabilities (Bug Bounty Program)

We maintain a responsible disclosure program to collaborate with the security community on identifying and resolving issues.

How to Submit a Report:

1. Reports must be submitted through our dedicated security contact form available in the 'Report a Vulnerability' link in the sidebar.
2. Include detailed steps to reproduce the vulnerability, including platform, browser, and relevant code or logs.
3. We adhere to the CVE standard for vulnerability reporting and aim for a 48-hour initial response time.

Unauthorized public disclosure before AIVRA has a chance to patch the vulnerability will disqualify the submission from our Bug Bounty Program.

Implementing Least Privilege Access for Automation Workflows

The principle of least privilege dictates that users and processes should only have the minimum permissions necessary to perform their required tasks.

Security Best Practices:

• Dedicated Service Accounts: Always run production automations using dedicated service accounts with tightly scoped permissions, rather than a full Administrator account.
• API Scope: When generating API keys, restrict the scope to only the resources the key needs to read or write (e.g., only access the 'Sales' module, not 'Billing').
• Regular Review: Conduct quarterly reviews of all active service accounts and API keys to remove any obsolete or over-privileged credentials.

Disaster Recovery (DR) and Service Availability Guarantees

AIVRA maintains a robust Disaster Recovery plan to ensure maximum service availability and rapid recovery from any unforeseen event.

Key DR Metrics:

• High Availability: Our platform operates across multiple availability zones to prevent single-point failures.
• RTO (Recovery Time Objective): Our target RTO for core services is less than 4 hours following a major failure.
• RPO (Recovery Point Objective): Data is backed up continuously, achieving an RPO of typically under 1 hour.