Governance and risk management
Intravo maintains a written security and privacy program with assigned ownership, risk assessment, policy review, incident management, vendor oversight, and evidence retention. The governing policy requires security-program review at least quarterly and policy review at least annually and after material changes. Control owners are responsible for implementation, retained evidence, testing, and remediation.
Our program is informed by recognized practices including NIST, CIS, applicable privacy law, and the AICPA Trust Services Criteria. References to these frameworks describe alignment goals and do not represent third-party certification.
Identity, access, and endpoints
- Policy requires unique identities, approved access, least privilege, role-based authorization, periodic access reviews, and prompt removal of access when no longer needed.
- Centrally managed identity, multifactor authentication for workforce and administrative access, and risk-based Conditional Access are required. Emergency-access exceptions must be documented, limited, monitored, and tested.
- Privileged access must be limited to authorized roles, monitored, and reviewed at least quarterly. Applications handling Confidential or Restricted information must enforce authorization on every server-side request.
- Company-managed endpoints must be enrolled in approved management, encrypted, protected by endpoint security, patched, and compliant before accessing protected services. Personal-device access requires approved applications and protection appropriate to the data and role.
Data protection and regional processing
Policy requires encryption in transit and at rest for Confidential and Restricted information using approved protocols, platform controls, and managed keys. New systems must use TLS 1.2 or later, with TLS 1.3 preferred. Secrets and service credentials must be kept outside source code in approved secret or key management services, with restricted access and lifecycle controls.
EU-origin customer content and personal data must remain within approved EU processing and storage paths. This requirement includes backups, recovery, identifiable telemetry, support access, and AI processing. Any proposed transfer outside the approved path requires a documented exception approved before processing, customer authorization, an applicable legal mechanism, and the safeguards described in our Data Residency standard. Some US-origin data may be processed in approved EU environments when contracts and law permit it.
Secure development and change management
Policy requires authorized production changes, peer review, testing appropriate to risk, deployment verification, rollback planning, and retained change evidence. Secure development includes secret scanning, dependency and code security analysis, and security review for material changes. Valid security findings must be resolved or formally accepted before release.
Logging, monitoring, and response
Policy requires central collection and investigation of security-relevant events, protected audit trails, assigned alert ownership, and regional routing of telemetry. Suspected security and privacy incidents must be reported immediately and assessed promptly through reporting, triage, containment, investigation, recovery, communication, and lessons learned.
When Intravo acts as a processor, it notifies the affected customer of a personal-data breach without undue delay according to contract and law and provides available information needed for the customer's assessment and notifications. Potential personal-data breaches are assessed promptly; incident-response exercises are required at least annually and after material changes.
Resilience and recovery
Policy requires service owners to define recovery objectives based on business impact and maintain encrypted, access-controlled, monitored, regionally compliant backups with restoration testing. Continuity and disaster-recovery exercises are required at least annually and after significant architectural changes. Contractual recovery commitments are stated in the applicable agreement.
Vendor and subprocessor security
Providers that may handle customer or protected company information are reviewed before approval and periodically thereafter based on risk. Reviews may include data use, security assurances, privacy terms, regional processing, incident obligations, retention, access, and offboarding. Material vendors and subprocessors require review at least annually, appropriate written obligations, and service-specific scope checks. Current customer-data subprocessors are listed on our Subprocessors page.
Assurance status
Intravo does not currently claim its own SOC 2 report, ISO 27001 certification, PCI DSS certification, or HIPAA certification. We are organizing controls and evidence for SOC 2 readiness, but readiness activity is not an independent examination and should not be interpreted as certification.
Where permitted, customers may request relevant policy summaries, architecture and data-flow information, completed questionnaires, vendor assurance documentation, and remediation status through our controlled diligence process.
Public policy documents
Read the Security, Privacy, and Compliance Policy Manual, version 2.1 (PDF), effective October 14, 2026, and the Security and Privacy Overview, version 1.0 (PDF), effective September 24, 2026. Both are approved for external distribution. The public policy library also includes privacy, data residency, and responsible AI documents.
Report a security concern
Please send suspected vulnerabilities or security incidents to security@intravo.com. Do not include sensitive customer data in the initial report. Our canonical reporting instructions are also available at /.well-known/security.txt.