Trust & compliance
Built to be audited.
Every claim on this site has a document behind it. This page lists what we hold, how we work, and what an evaluation team can request before an RFP response.
Certifications
What we hold. Independent attestation, renewed on schedule. Ask for the report itself, and read its scope section — we expect you to.
SOC 2 Type II
Security, availability and confidentiality controls, tested by an independent auditor over an observation period rather than at a single point in time.
Request the report →ISO/IEC 27001
A certified information security management system covering the engineering, hosting and delivery environments that touch client data.
Request the certificate →PIPEDA
Personal information handled under Canada’s federal private-sector privacy law, with a named Privacy Officer accountable for it.
Read the privacy policy →Canadian data residency
Government data stored and processed in Canadian regions, with no cross-border transfer unless the client authorizes it in writing.
Evidence
What you can request. Shared under NDA, usually within two business days, so the documents are in hand before the evaluation grid is.
Audit reports
The full SOC 2 Type II report and the ISO 27001 certificate with its Statement of Applicability — not summary letters.
Request under NDA →Penetration test summary
The most recent independent test: scope, method, findings by severity and the date each was remediated.
Request under NDA →Algorithmic Impact Assessment support
Model documentation, evaluation results and logging design prepared for the Directive on Automated Decision-Making.
Request under NDA →Privacy Impact Assessment inputs
Data flows, retention schedules and subprocessor locations in the form a PIA author needs them.
Request under NDA →
Security practices
How we work. The controls behind the certificates, stated as commitments a contract can hold us to.
Encryption
TLS 1.2 or higher in transit and AES-256 at rest, with client-managed keys available for every deployment.
Identity and access
Single sign-on with enforced multi-factor authentication, least-privilege roles, and quarterly access reviews.
Logging and audit
Every model output recorded with its inputs, retrieved sources and model version, retained to the client’s schedule.
Vulnerability management
Continuous dependency scanning, critical patches within 72 hours, and an annual independent penetration test.
Incident response
A tested response plan, with clients notified of any incident affecting their data within 24 hours of confirmation.
Model governance
No client data used to train models for anyone else. Model changes are versioned and notified before they ship.
Website subprocessors
What runs this site. The services that process information submitted through ainvento.com. Each engagement has its own list, agreed in the contract.
Vercel
Website hosting and delivery. Serves the pages of this site; stores no briefing requests.
Supabase — Canada (Montréal)
Database for briefing requests submitted through this site, in the ca-central-1 region.
Resend
Delivers the internal notification email when a briefing request arrives.
Evaluating us for an RFP?
Tell us the procurement and the deadline. We will send the security package and a named contact for technical questions.