Private launchEffective 3 November 2026 · Analivo Technologies
Management owns the security program, approves these policies, and reviews them at least annually or after any significant change or incident. Each policy names an owner responsible for its operation. Staff and contractors with system access acknowledge these policies on joining and annually.
Access follows least privilege. Customer firm access is granted only by invitation or administrator approval; roles (admin, analyst, reviewer) are assigned by firm administrators and stored separately from user profiles. Outside investors receive per-deal access only. Internal production access is limited to named personnel, reviewed quarterly, and removed within one business day of leaving.
Suspected incidents are reported to the security owner immediately, triaged by severity, contained (including credential revocation), investigated using audit logs, and remediated. Affected customers are notified within 72 hours of confirming unauthorised access to their data. Every incident gets a written post-incident review with corrective actions.
Product and database changes are made through versioned code and migrations, tested automatically (including citation, pipeline and cross-firm isolation checks) before release, and published deliberately. Access-control changes require the isolation check to pass before release.
Subprocessors handling customer data are assessed before use and reviewed annually for security commitments (such as their own SOC 2 or ISO 27001 reports), confidentiality terms and data location. A subprocessor list is maintained and provided to customers on request.
Customers set retention periods per firm and per deal; an automated nightly job deletes expired documents, extracted text and findings. Deleting a document removes its derived data. Backups expire on the hosting provider’s schedule.
Management maintains a risk register covering confidentiality, availability, AI accuracy and vendor risk, assesses likelihood and impact, assigns owners and treatments, and reviews it at least annually.
AI outputs are treated as hypotheses until verified. Every finding must cite a verbatim source quote that is checked against the stored document text; unmatched quotes are flagged. Only analyst-verified findings appear in summaries, memos and investor views. Financial reconciliation uses deterministic arithmetic.
Personnel use company-managed accounts with multi-factor authentication where available, keep devices updated and encrypted, never copy customer data to personal storage, and complete security awareness training on joining and annually.
The service runs on managed infrastructure with provider-managed backups. Stalled processing jobs are recovered automatically. Recovery procedures are reviewed annually.