Security & Subprocessors

Security approach

Indavera is designed as a multi-tenant platform with customer data logically separated at the database level through PostgreSQL row-level security. Uploaded files are encrypted at rest in cloud storage. Authentication is handled through Auth0, and sensitive actions can require multi-factor authentication. Platform actions are recorded through an append-only audit log.

These controls reduce risk but do not eliminate it. Security practices may evolve as the platform and threat environment change.

Current service providers

• Auth0 — identity and authentication; termination workflow anonymizes user identity fields, blocks access, and revokes active sessions while preserving a non-identifying account placeholder where needed for audit attribution.
• Stripe — subscription billing and payment processing; Indavera can remove the customer payment profile/stored payment methods, while Stripe may separately retain financial transaction/invoice records under its own obligations.
• Amazon Web Services (S3) — encrypted file storage; supported uploaded files are deleted when the corresponding document record is purged.
• Anthropic / OpenAI — stateless AI-assisted processing for invoked features; Indavera does not use persistent-memory/file-storage features for these workflows, while provider request-log handling remains governed by applicable terms/contracts.
• NameScan — sanctions/PEP screening; no Indavera-triggered self-service deletion path for provider-held scan history is currently available.
• Sentry — application error monitoring, configured not to receive default personal information.
• Transactional email provider — to be confirmed before publication of a definitive vendor list and deletion process.

Upload malware scanning

The platform contains integration for ClamAV malware scanning and is designed to require it in production. Its live production operation should be operationally verified before this page makes an affirmative claim that every upload is scanned.

Security certifications

Indavera does not display "SOC 2 Type II," "SOC 2 certified," or equivalent wording unless it has a current, supportable SOC 2 Type II examination/report. As of the September 23, 2026 codebase/legal review, no such examination had been identified.