Trust Center
Built so your security team can
say yes.
Everything Neivan publishes about how we protect customer data, which AI providers see it, who else we share it with, and how we respond when things go wrong, in one place.
Compliance & certifications
SOC 2
No SOC 2 report yet. Written security policies are modelled on SOC 2; an independent audit is planned.
GDPR & UK-GDPR
The Service is offered in the US today. Our DPA includes SCC terms for any EU/UK data.
CCPA
California consumer rights honored regardless of residence.
HIPAA
On our roadmap. Contact us to discuss regulated-industry requirements.
Security
Encryption
HTTPS with HSTS in transit, encrypted at rest, and stored credentials sealed with AES-256-GCM.
Two-step sign-in (MFA)
Anyone can turn on an authenticator app. Admins can require it for their whole organization.
Access control
Role-based permissions, approval gates, and an audit log whose entries cannot be edited.
Single sign-on & SCIM
SAML single sign-on and SCIM user provisioning (add, deactivate and reactivate people) are available on request; we set them up with your IT team. Group sync is not supported yet.
Incident response
Written incident-response plan; affected customers notified within 72 hours of confirmation.
Vulnerability program
Report issues to [email protected]. Automated scanning and an independent pentest are planned.
AI and your data
No training on your data
Neivan does not use customer content to train any model, and the AI providers we use do not train on content sent through their APIs.
The AI providers we use
Neivan-managed AI runs on Anthropic and OpenAI. Both are on our subprocessor list, with what they process.
Bring your own key
Connect your own key for OpenAI, Anthropic, Google Gemini, Mistral, DeepSeek or xAI. Those requests run under your account and your terms with that provider.
Agents ask before they act
You choose which actions need a person to approve them first, and every step is written to the audit log.
Observation (Neivan Assessment)
Privacy
Operations
Service status
Incident notifications go to affected customers directly. A public status page arrives with general availability.
Service Level Agreement
Availability goals and support commitments during the beta.
Changelog
Monthly roundups of what shipped, in plain English.
Acceptable Use
What customers and their AI agents may and may not do.