Security and Data Handling

Access is authenticated through Clerk, with organisation membership determining the workspace a person can reach. API routes are protected by session or scoped bearer token. Agent access is issued as revocable scoped keys rather than shared credentials, so an integration can be withdrawn without rotating anything else. Administrative surfaces that issue product access are gated separately from customer administration and fail closed when unconfigured — a customer administrator cannot reach them.

Evidence arriving with missing provenance or low extraction confidence is quarantined rather than admitted. Quarantined material does not silently influence dashboards, answers, or recommendations; it waits for a human to approve or reject it. Where the evidence base is too thin to support a claim, the product refuses and says so instead of producing a plausible answer — a visible refusal is a security property, not a limitation.

Consequential actions require approval from a named, identity-bound human. Recommendations, promotion of a finding to canonical status, and outbound packs all pass a gate before they take effect, and the consequence is shown before the commitment rather than after.

Ingestion, review, recommendation, and policy actions emit audit events recording who acted, what changed, when, and on which evidence. The trail is written once and is exportable, so a decision can be reconstructed later by someone who was not present.

Traffic is served over TLS. Workspace data and vector indexes are held in managed Postgres and original files in object storage, both encrypted at rest by the underlying platforms. The standard deployment runs in the United States; other jurisdictions are agreed in writing before onboarding. The full subprocessor list is in the data processing addendum.

Messaging and notification surfaces carry less than the product itself. Content that is restricted or unprovenanced is redacted or replaced with a link back into the workspace rather than posted into a channel where scoping no longer applies.

Pinavia is pilot-stage software and does not hold SOC 2 or ISO 27001 certification today; a readiness assessment has been carried out and the gaps are known. Penetration testing by an external party has not yet been completed. These are stated here because a security page that omits them is answering a different question than the one a risk officer is asking.

Send security reports to hello@pinavia.io with enough detail to reproduce the issue. We acknowledge within two business days, keep the reporter updated while we investigate, and do not pursue researchers who report in good faith and avoid accessing other customers' data.