Security, Privacy & Compliance
We take the security of your data seriously. Here is an overview of the controls and practices we have in place to protect your information.
Encryption in Transit & At Rest
All data is encrypted in transit using TLS 1.2+ and at rest using industry-standard AES-256 encryption.
Hosted on AWS
Primary data resides in AWS US East Zone with automated backups in AWS US West Zone. Regular BCDR testing ensures recovery readiness.
Annual Penetration Testing
Independent security experts perform annual penetration tests. All identified vulnerabilities are remediated before issues go public.
Multi-Factor Authentication
MFA is enforced for all access to production systems. Customer accounts can also enable mandatory MFA for their team.
Network Segmentation
Production systems are isolated in Virtual Private Clouds (VPCs). Access to production databases requires unique accounts with secure authentication.
Quarterly Access Reviews
Access to sensitive systems is reviewed quarterly. Remote access to production is permitted only for authorized employees using enforced MFA.
Incident Response
When potential unauthorized access is detected, alerts are instantly sent via Email and Slack to our security team. Customers are promptly notified after the conclusion of manual audit. Our team follows a documented incident response plan with defined escalation paths and SLAs.
GDPR Compliance
Affiniv is GDPR-ready. Our policy covers lawful basis for processing, data subject rights, breach notification (Articles 33–34), and retention minimization. EU customers can request data access, rectification, erasure, or portability by contacting us at support@affiniv.com.
Customer data and content are governed by our Terms of Service. Affiniv acts as a data processor on behalf of customers, who retain control over what data is collected and how it is used.
Sub-processors
We work with a small, vetted list of sub-processors to deliver our services:
Security questions?
Contact our security team at support@affiniv.com. For privacy data requests, include your organization name and the type of request.