Security @ Ava (Public)

If you have any questions check out our FAQ at the bottom of the page or contact security@ava.me. For system status please visit avascribe.statuspage.io. Our Privacy Policy & Terms of Service. Need a translation or have a question? Contact us directly.

Compliance

HIPAA (.health)

GDPR Compliant (EU)

CCPA Compliant (CA, US)

FERPA/COPPA ( Student DPA →) (.edu)

Resources

Resource access (some upon request)

• Latest Vulnerability Scan (upon request)
• Latest Penetration Test (upon request)
• Data Processing Addendum
• Proof of Insurance (upon request)
• Ava Security Policy Packet (upon request)
• HIPAA compliance
• Ava IaaS SOC-2 Report

FAQ

• Do you train AI models on customer data?
• Is data in your platform encrypted both in transit and at rest?
• Where do you store data?
• How is Ava free? Do you sell our data to third parties?
• How long do you store meeting recordings and other customer data?
• Can we sign a Mutual Non-disclosure Agreement?
• Is authentication through SSO? Is multi-factor auth available?
• Do you have cybersecurity insurance?
• What happens to my data if I delete my account?

Controls

• Infrastructure security
• Organizational security
• Product security
• Internal security procedures

Our Security Technical & Organizational Measures

Data Processed

User Data
Name, Email, Phone, IP, Hearing, Organization

Meeting Content Data:
Recording (Audio), Transcript, Speakers

Ava Subprocessors

Our Security Policies ( ask us for full PDF package)

Security

Product Security

Product security is of paramount importance at Ava. Ava uses a software development lifecycle in line with general Agile principles. Software patches are released as part of our continuous integration process. Patches that can impact end users will be applied as soon as possible but may necessitate end user notification and scheduling a service window.

Ava performs continuous integration, allowing us to respond rapidly to both functional and security issues. This philosophy is central to our development methodology.

Physical Security

The Ava production infrastructure is hosted in Cloud Service Provider (CSP) environments. Physical access is strictly controlled by professional security staff. Authorized staff must pass two-factor authentication to access data center floors.

Corporate Security

Ava leverages internal services that require transport level security for network access and individually authenticate users. All personnel undergo regular security training to ensure they're equipped to handle security-oriented challenges.

See the AWS Shared Responsibility Model.

Data Protection

Authentication and Access Management

End users may log in to Ava using an Identity Provider, leveraging security assertion protocols. All requests to the Ava's API must be authenticated.

Protection of Customer Data

Data submitted to the Ava service is protected in transit and encrypted at rest. Customer Data is not authorized to exit the Ava production service environment, except in limited circumstances.

Ava maintains distinct data centers in the United States and the EU. Access to Customer Data is limited to those with a business requirement. Multiple layers of access controls are in place, and access is monitored.

Compliance

Certifications, Attestations and Frameworks

Ava maintains active PCI compliance and provides HIPAA-compliant log management and security monitoring.

Laws and Regulations

Ava is compliant with GDPR and CCPA. For more information about our position on the GDPR, please visit this link. For CCPA visit here.

Vendor Management

Ava has established a vendor management program to assess controls in place with third parties.