Security & Trust

Certifications and audits

• SOC 2 Type II — audited annually by an independent CPA firm; report available under NDA.
• Annual external penetration test — remediation tracked to closure, summary available on request.
• Annual internal security review of the platform, infrastructure and vendor estate.

Data protection

• Encryption in transit with TLS 1.2+; HSTS enabled on all public endpoints.
• Encryption at rest with AES-256 for databases, object storage and backups.
• Customer data is logically segregated per tenant; access is authorised per request, not per service.
• Backups are taken continuously, encrypted, and restore-tested quarterly.

Access control

• Mandatory multi-factor authentication for all Corvane personnel, including contractors.
• Least-privilege role model; production access requires an approved, time-boxed elevation.
• Customer-facing authorisation is role-based, with per-user quotas for API and model-backed features.
• Immutable audit logging of administrative actions and data exports, retained 12 months.

Engineering practice

• Peer-reviewed changes, automated tests, and deployment behind feature flags.
• Dependency and container scanning on every build; critical findings block release.
• Separate development, staging and production environments with no shared credentials.
• Secrets held in a managed secret store; no credentials in source control.

Artificial intelligence and model providers

Some internal Corvane tooling uses large language models accessed through contracted cloud providers. These uses are limited to software development assistance on our own repositories, summarisation and translation of internal documents, and internal question answering over our own documentation.

• Available only to authenticated employees behind corporate single sign-on.
• Per-user quotas and full audit logging in our cloud project.
• Inputs and outputs retained at most 30 days for security review, never used to train or fine-tune a model.
• No consumer-facing or public-facing chat interface is operated by Corvane.

Subprocessors

Corvane uses a limited set of infrastructure providers. The current list, with purpose and processing location, is available on request from platform@v.cd. Customers are notified at least 30 days before a new subprocessor begins processing customer data, and may object in writing.

Incident response

• Documented incident response plan, exercised at least annually.
• Customer notification within 72 hours of confirming a personal data breach.
• Post-incident review shared with affected customers.

Business continuity

Production runs across multiple availability zones with automated failover. We target 99.9% monthly availability, publish status at the platform level, and maintain a tested disaster recovery procedure with a 4-hour recovery time objective for the primary datastore.

Vulnerability disclosure

Report suspected vulnerabilities to security@v.cd. We acknowledge within two business days, will not pursue legal action for good-faith research conducted within scope, and will credit reporters who wish to be named.

Questions

Security questionnaires, our SOC 2 report, and our data processing agreement are available from platform@v.cd.