# Aiventic Security & Compliance

Canonical: https://www.aiventic.ai/security

Aiventic is SOC 2 Type 2, ISO 27001, and HIPAA compliant. The live posture, certifications, and reports are published in a public Trust Center at https://trust.inc/appstreamstudio.

## Certifications

- **SOC 2 Type 2** — current report available on request through the Trust Center after an NDA. Most procurement teams receive it within one business day.
- **ISO 27001**
- **HIPAA** — Aiventic operates under HIPAA-compliant controls and will execute a Business Associate Agreement (BAA) with covered entities and business associates that need one. Request a BAA through the Trust Center or your account team.

## Controls

- **Encryption everywhere** — TLS 1.2+ in transit, AES-256 at rest across the application, databases, and backups.
- **Identity and access** — SSO via SAML 2.0 and OAuth, role-based access control, enforced MFA for all administrative access, least privilege by default.
- **Continuous monitoring** — centralized logging, automated alerting, and continuous vulnerability scanning across production.
- **Data protection** — encrypted backups with point-in-time recovery, environment isolation, and documented retention and deletion policies.

## Data residency

Customer data is stored in encrypted cloud infrastructure within the United States, on providers holding their own SOC 2, ISO 27001, and HIPAA-aligned controls. Environment isolation prevents cross-tenant data exposure.

## Single sign-on

SAML 2.0 SSO with major identity providers including Okta, Microsoft Entra (Azure AD), and Google Workspace. MFA is supported and can be enforced for all users.

## Incident response

A documented incident response process with notification timelines aligned to SOC 2 and HIPAA requirements. Affected customers are notified directly; broader incidents are posted to the Trust Center.

## Reporting a vulnerability

Email security@aiventic.ai. Reports are acknowledged within one business day. Coordinated disclosure is welcome and credited where appropriate.

## Related

- Trust Center: https://trust.inc/appstreamstudio
- [/privacy-policy](https://www.aiventic.ai/privacy-policy)
- [/terms-of-service](https://www.aiventic.ai/terms-of-service)
- [/industries/healthcare](https://www.aiventic.ai/industries/healthcare) — HIPAA-covered medical equipment service