Security one-pager
For procurement, IT security and risk teams. Each line is answered in full at eaviora.com/trust.
Where data lives
- Stored in Canada, in the Montréal region of our database provider.
- The application runs in the United States, US East region.
- Files and backups stay in the storage region.
Isolation
- Row-level security forced on every organisation’s tables.
- The application role cannot bypass it; a missing filter returns no rows.
- Five layers, from request checks to the database.
Encryption
- AES-256 at rest on database, files and backups (provider-attested).
- HTTPS with strict transport security (HSTS); TLS 1.0 and 1.1 refused.
- API keys and provisioning tokens stored hashed, shown once.
Backups and recovery
- Seven rolling daily backups, in the same region.
- Point-in-time recovery is not enabled: up to one day of changes at risk.
AI governance
- eAvy proposes; a person accepts, edits or rejects before a write.
- No AI can move a record’s workflow stage.
- Agents read only the fields they are set up to read; no reporter identity.
- eAviora trains no model on your data. AI is processed through OpenRouter.
Confidential reporting
- Five confidentiality levels on every record.
- A confidential report carries no reporter identity on the record.
- Anonymous reports are hidden from everyone, our staff included.
Sign-in and access
- SAML 2.0 single sign-on (Okta, Microsoft Entra, Google), enforceable.
- SCIM 2.0 provisioning and removal.
- Authenticator codes, session list, sign out everywhere.
- API keys scoped read, write or admin.
Audit trail
- App and API changes write their audit entry in the same transaction.
- Append-only and chained in the database.
- Searchable in the app; exports as JSON or CSV.
Portability
- Export every record and the audit log as JSON or CSV, any time.
- Occurrences export as E5X for ECCAIRS.
- CSV import up to 50 MB, with column mapping.
Not yet
- SOC 2 Type I in preparation; no certification claimed.
- No third-party penetration test performed yet.
- ISO 27001 not held. Bring-your-own-key is not supported.