Encryption in transit: All traffic to SVEND is served over TLS. Connections are terminated at the network edge and no application content crosses the public network unencrypted.

Encryption at rest: Sensitive fields are encrypted at the application layer before they reach the database, using authenticated symmetric encryption. Encryption keys are held outside the database.

Your data stays yours: Process data you upload for analysis is used only to produce the analysis you requested. We do not sell it, share it, or use it to train models.

Each organization's data is isolated at the database layer with PostgreSQL row-level security. Isolation is enforced by the database on every query — not only by application code — so one tenant's records are never reachable from another tenant's session.

Password security: Passwords are hashed with Argon2, a memory-hard algorithm designed to resist offline cracking. We never store or log passwords in plaintext.

Two-factor authentication: Time-based one-time-password (TOTP) two-factor authentication is available on every account and works with any standard authenticator app.

Brute-force protection: Repeated failed sign-in attempts are rate-limited and locked out, and both password and second-factor failures feed the same protection.

A hash-chained audit trail — each entry linked to the one before it, so the record is tamper-evident and cannot be silently altered after the fact — is in build for August 2026. It is not yet available on any account.

Every paid plan includes unlimited data export — your analyses and records leave in open formats whenever you want them. On account closure, data remains available for export for 90 days, after which it is deleted. You may request deletion at any time.

SVEND follows SOC 2 Type II aligned practices and honors GDPR and CCPA data-subject rights. For a current compliance summary or to raise a security question, contact [email protected].