Security & Compliance
Security and compliance controls
Agree with your IT and compliance teams how the system handles data, who can use it, and which actions need approval. We document the controls, test them before release, and keep the audit records your compliance program relies on.
Where your data lives
Hosted where it fits
Most mid-market companies run in the cloud with one of our top-tier partners. Private and hybrid deployments store data in Ixvara’s Tier III data center, a facility with SOC 2 attestation. Enterprise deployments can run the AI firewall and the whole platform inside your own infrastructure, on a validated hardware configuration.
Sign in with Microsoft 365
Employees sign in with the Microsoft 365 accounts they already use, so access follows the identities and groups you manage today.
Your own encryption keys
Each company’s data is encrypted with its own keys, managed in a key management platform, and kept in a dedicated configuration.
A dedicated AI firewall
In most configurations, the AI firewall that decides where your requests run is a dedicated instance for your company.
Applies to Private AI, AI for IT operations, and custom apps. AI voice agents run on a separate platform; ask us for their details.
Frameworks our controls follow
Ixvara runs its own security practice to two widely used frameworks. They are internal discipline, applied to how we build and operate systems, not a third-party attestation.
Followed
SOC 2 Trust Services Criteria
Our internal controls for access, change management, monitoring, and incident response are designed around the Trust Services Criteria.
Followed
NIST Cybersecurity Framework
We organize our security practice around its functions: govern, identify, protect, detect, respond, and recover.
Ixvara has not completed a SOC 2 audit and does not claim SOC 2 or NIST certification. Ask us about our controls during your security review.
Controls we define with your team
Identity and access
Specify user and service identities, approved information sources, permitted tools, and access levels.
Approval and escalation
Decide which actions need approval, how uncertain cases escalate, and who can stop or override them.
Records and traceability
Keep relevant inputs, sources, action records, system versions, and verification results under the agreed retention policy.
Testing and release control
Test representative cases and failures. Check model, prompt, tool, and integration changes before release.
Data handling and deployment
Specify where models run and where prompts, retrieved information, storage, backups, and logs may go. In a validated local-only deployment, model execution has no automatic cloud fallback.
Operating responsibility
Agree usage limits, support ownership, escalation, service measures, and exception reviews.
Controls depend on the implemented system and service scope. Private deployment alone does not establish compliance or certification.
Agree ownership and access before delivery
Document software ownership, licenses, provider terms, data access, and deployment responsibilities.
What your team receives
- Architecture and integration documentation
- Source and configuration access as contracted
- Evaluation cases and operating runbooks
- Release and operational history
- Data export and retention responsibilities
- A scoped transition plan if operations move in-house
The agreement specifies the handover deliverables and transition work.
Discuss your project
Tell us what needs to improve, the systems involved, and your data requirements.