Security at Every Layer
Your compliance data is sensitive. We protect it with enterprise-grade encryption, strict tenant isolation, multi-factor authentication, and immutable audit logging. Security isn't a feature — it's our foundation.
Encryption
Every byte of your data is encrypted at rest and in transit. We use AES-256 for data at rest, TLS 1.3 for data in transit, and per-tenant encryption keys managed through AWS KMS. Our zero-knowledge architecture ensures that even our infrastructure team cannot access your plaintext data.
Encryption at Rest
All data stored in our databases, file storage, and backups is encrypted using AES-256-GCM. Each tenant has a unique Data Encryption Key (DEK) wrapped by a Key Encryption Key (KEK) in AWS KMS. Keys are rotated automatically on a configurable schedule.
Encryption in Transit
All API traffic, web connections, and inter-service communication is encrypted with TLS 1.3. We enforce HSTS, disable legacy protocols, and use certificate pinning for mobile clients. Internal service mesh uses mutual TLS (mTLS) for service-to-service encryption.
Customer-Managed Keys
Enterprise plan customers can bring their own encryption keys (BYOK). Keys are stored in your own cloud KMS and never leave your infrastructure. Alternivite requests envelope encryption operations without ever seeing the plaintext key material.
Data Privacy
Your data belongs to you. We never sell, share, or monetize your information. Alternivite operates on a strict data minimization principle — we collect only what's necessary to provide the service and nothing more.
No Data Selling
We will never sell, rent, license, or otherwise distribute your data to third parties for marketing, advertising, or any purpose other than providing you the contracted service. This is a contractual commitment in our Terms of Service.
Data Minimization
We collect only the data required to deliver compliance features: your organization profile, uploaded documents, and user accounts. We don't track browsing behavior, sell analytics, or build advertising profiles.
Right to Erasure
You can request complete data deletion at any time. Upon request, we permanently delete all your data within 30 days, including backups, logs, and derived data. You receive a deletion confirmation certificate.
Tenant Isolation
Every organization operates in a completely isolated workspace. Tenant boundaries are enforced at the database, API, file storage, and application layers. A bug or misconfiguration in one tenant can never expose or affect another tenant's data.
Database-Level Isolation
All database queries are scoped by tenant ID using row-level security (RLS) policies enforced at the database engine level. The application layer cannot bypass RLS — even a SQL injection attack cannot cross tenant boundaries.
File Storage Isolation
Each tenant's documents are stored in isolated S3 prefixes with tenant-specific KMS keys. Pre-signed URLs include tenant scoping and expiration. Cross-tenant file access is structurally impossible.
API Scoping
Every API request carries a signed tenant context token. Middleware validates tenant scope before processing any request. API keys are scoped to a single tenant and cannot be used across organizations.
Authentication
Secure access to your compliance platform with industry-standard authentication protocols. We support multiple authentication methods including password-based login, TOTP multi-factor authentication, and enterprise SSO via SAML and OIDC.
Secure Password Handling
Passwords are hashed with bcrypt (cost factor 12) and salted with unique per-user salts. We never store plaintext passwords. Failed login attempts trigger progressive rate limiting and account lockout after 5 consecutive failures.
Session Management
Sessions use cryptographically random tokens stored in httpOnly, secure, SameSite cookies. Sessions expire after 24 hours of inactivity. Concurrent session limits are configurable per tenant. Users can view and revoke active sessions.
Enterprise SSO
Enterprise plan customers can integrate with their identity provider via SAML 2.0 or OpenID Connect. Supported providers include Azure AD, Okta, Google Workspace, and Auth0. Users inherit their IdP groups and attributes for role mapping.
TOTP Multi-Factor Authentication
Time-based One-Time Password (TOTP) adds a critical second layer of security. Even if a password is compromised, attackers cannot access your account without the second factor. TOTP works with any authenticator app including Google Authenticator, Authy, and 1Password.
Setup & Enrollment
Users enable TOTP from their security settings. A QR code is generated using the TOTP secret key. Scanning the code with any TOTP-compatible authenticator app completes enrollment. Recovery codes are provided for backup access.
Enforcement Policies
Tenant administrators can enforce TOTP for all users, specific roles, or allow optional enrollment. When enforced, users who haven't enrolled are required to set up TOTP on their next login before accessing any platform features.
Recovery Codes
Each user receives 10 single-use recovery codes upon TOTP enrollment. Codes are displayed once and stored securely (hashed). If a user loses their authenticator device, they can use a recovery code to regain access and re-enroll a new device.
Audit Logs
Every action in Alternivite is recorded in an immutable, append-only audit log. From document uploads to user role changes, nothing escapes the trail. Audit logs are cryptographically signed to prevent tampering and retained according to your compliance requirements.
Immutable & Append-Only
Audit records are write-once. No update or delete operations are permitted on log entries. Each record includes a SHA-256 hash chain linking it to the previous record, making any tampering immediately detectable.
Comprehensive Coverage
Logs capture actor identity, action type, resource affected, timestamp, IP address, user agent, and before/after state snapshots for data modifications. Failed authentication attempts, permission denials, and system errors are also logged.
Configurable Retention
Basic plan: 30 days. Professional plan: 1 year. Enterprise plan: unlimited retention with configurable archive policies. Logs can be exported as JSON, CSV, or PDF for auditor requests with a single click.
Role-Based Access Control
Granular permissions ensure every team member can only access what they need. Define custom roles with fine-grained permissions per resource type. RBAC is enforced at the API, service, and UI layers simultaneously.
Predefined Roles
Admin (full access), Manager (manage team and documents), Reviewer (read and approve), Viewer (read-only). Each role has a clearly defined permission set. Role changes are logged with before/after state for audit purposes.
Custom Roles
Create roles with granular permissions: read, write, approve, publish, delete per resource type. Define which features, settings, and data each role can access. Custom roles integrate with SSO group mapping for automatic assignment.
Principle of Least Privilege
New users default to the most restrictive role. Permission escalation requires explicit admin approval. Access reviews can be scheduled to periodically audit who has access to what, with recommendations for revoking unused permissions.
Backups & Disaster Recovery
Your data is backed up daily with automated snapshots stored in a separate geographic region. We maintain point-in-time recovery capabilities and test our disaster recovery procedures quarterly. RPO: 24 hours. RTO: 4 hours.
Automated Daily Backups
Full database backups run daily at 02:00 UTC. Incremental backups run every 6 hours. All backups are encrypted with separate backup keys stored in a different KMS region from production data.
Geographic Redundancy
Backups are stored in at least two geographic regions (eu-west-1 and af-south-1). If the primary region experiences a total outage, backups in the secondary region can be restored within the 4-hour RTO window.
Point-in-Time Recovery
Continuous transaction logging enables point-in-time recovery to any moment within the retention window. This means we can restore your data to the exact state it was in before an accidental deletion or corruption event.
Infrastructure Security
Alternivite runs on enterprise-grade cloud infrastructure with security built into every layer. From network segmentation to container orchestration, our infrastructure is designed to resist and detect attacks.
Cloud-Native Architecture
Deployed on AWS with VPC isolation, private subnets, and security groups. Production databases run in isolated subnets with no public internet access. All administrative access goes through a hardened bastion host with MFA.
Container Security
Application containers run with read-only root filesystems, non-root users, and resource limits. Container images are scanned for vulnerabilities before deployment. Only signed images from our private registry are permitted to run.
DDoS Protection
AWS Shield Standard provides always-on DDoS protection. AWS Shield Advanced is enabled for enterprise tenants, providing sophisticated attack detection, near real-time visibility, and 24/7 DDoS Response Team access.
AI Processing & Data Handling
Your documents are processed through our AI pipeline with strict data isolation. AI models never retain or learn from your data. Processing happens in isolated, ephemeral containers that are destroyed after each analysis.
No Model Training on Your Data
Your documents and compliance data are never used to train, fine-tune, or improve AI models. Our AI pipeline is stateless — it processes your input and returns the output without retaining any data beyond the session.
Ephemeral Processing
Each AI analysis runs in an isolated, ephemeral container. Once processing completes, the container is destroyed along with any in-memory data. No document content persists in the AI processing layer.
Confidential Computing
AI workloads run on AWS Nitro Enclaves for sensitive processing. Enclave memory is isolated from the host OS, hypervisor, and other tenants. This provides hardware-level protection for data during AI analysis.
Data Retention
You control how long your data is retained. We follow a strict retention policy aligned with your plan and compliance requirements. Data is permanently and irreversibly deleted when it reaches the end of its retention period or upon your request.
Plan-Based Retention
Basic: 30 days for audit logs, documents retained while account is active. Professional: 1 year for audit logs, unlimited document retention. Enterprise: configurable retention policies per data type with archive support.
Deletion Process
When data reaches its retention limit or deletion is requested, it enters a 30-day grace period. During this period, you can export or restore the data. After 30 days, data is permanently overwritten using cryptographic erasure (key destruction).
Backup Retention
Backups follow a 90-day rolling retention. Older backups are automatically purged. Enterprise plans can extend backup retention to 1 year with point-in-time recovery to any day within the backup window.
GDPR Alignment
Alternivite is designed to help you comply with the General Data Protection Regulation. Our platform itself is built in alignment with GDPR principles, and our tools help you achieve and maintain GDPR compliance for your organisation.
Data Processing Agreement
We provide a comprehensive Data Processing Agreement (DPA) to all customers. The DPA covers the nature and purpose of processing, types of personal data, categories of data subjects, and our obligations as a data processor under GDPR Article 28.
Data Subject Rights
We support data subject access requests (DSARs), right to rectification, right to erasure, right to data portability, and right to restrict processing. Our platform includes automated tools to help you respond to DSARs within the 30-day deadline.
EU Data Residency
Enterprise customers can choose EU data residency (Frankfurt region). All processing and storage remains within EU borders. We do not transfer EU personal data outside the EU without appropriate safeguards (SCCs or adequacy decisions).
CCPA Alignment
Alternivite supports compliance with the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA). Our platform provides tools to manage consumer rights requests and maintain CCPA-compliant privacy practices.
Consumer Rights Support
Our platform helps you handle the right to know, right to delete, and right to opt-out of sale of personal information. Automated workflows guide your team through each request type with verification steps and response templates.
No Sale of Personal Information
Alternivite does not sell, share, or monetize personal information of California consumers. We do not use personal information for behavioral advertising. This commitment is documented in our Privacy Policy and DPA.
Privacy Policy Templates
Generate CCPA-compliant privacy policies with our AI document generator. Templates include all required disclosures: categories of personal information collected, purposes, third-party sharing, consumer rights, and contact information.
Security Best Practices
Security is a shared responsibility. We implement industry best practices across our organisation and provide guidance to help you maintain a strong security posture within your team.
Secure Development Lifecycle
Every code change goes through peer review, automated SAST/DAST scanning, dependency vulnerability checks, and staging deployment before production. Critical security patches are deployed within 24 hours of discovery.
Penetration Testing
We engage independent security firms for annual penetration testing and quarterly vulnerability assessments. Critical findings are remediated within 48 hours. Enterprise customers can request our latest pentest report under NDA.
Incident Response
We maintain a documented incident response plan with defined roles, escalation procedures, and communication templates. Breaches affecting personal data are reported to supervisory authorities within 72 hours as required by GDPR.
Employee Security Training
All team members complete security awareness training upon hiring and quarterly refreshers. Training covers phishing awareness, secure coding practices, data handling procedures, and incident reporting. Access to production is limited to essential personnel.
Our Security Commitment
Security is not a feature we bolt on — it's the foundation we build on. Every architectural decision, every line of code, and every operational procedure is designed with your data's protection as the top priority. We earn your trust every day.
Questions About Our Security?
Our security team is happy to answer your questions, share documentation, or discuss your specific requirements under NDA.