Trust and compliance
Where Sovaria stands on SOC 2, ISO 27001, HIPAA, GDPR and PCI today, how your data is protected, who processes it, and what you can ask us for.
This page says plainly what Sovaria has and hasn't got. We update it when something changes, and we never list a certification before the auditor's report or certificate is issued.
#Certifications and audits
| Standard | Status today | Next step |
|---|---|---|
| SOC 2 Type I (Security, Availability, Confidentiality) | Not certified. We are preparing for the audit: policies, a control map and automated evidence collection are in place. | Engage an independent auditor for a Type I report |
| SOC 2 Type II | Not certified. | An observation period after Type I |
| ISO/IEC 27001:2022 | Not certified. Our controls are mapped to Annex A. | Certification after SOC 2 Type I |
| HIPAA | HIPAA mode is available on Enterprise with a signed BAA (HIPAA mode and PHI projects). HIPAA has no official certification, and Sovaria has not had a third-party HIPAA assessment. | — |
| GDPR | Users can export and delete their own data through the API. Sovaria acts as a processor for the data in your projects. | A public DPA and sub-processor notice |
| PCI DSS | Sovaria never stores card numbers. Payments are handled by Razorpay and Stripe, which are PCI DSS certified. | — |
| External penetration test | Not done yet. We run our own automated security tests and full code audits. | An independent pentest before Type II |
#How your data is protected
| Area | What Sovaria does |
|---|---|
| Encryption in transit | TLS 1.2 and 1.3 only on every public endpoint, with HSTS and strict security headers. Database connections from your apps use TLS. |
| Encryption at rest | The platform database is on encrypted Amazon RDS storage. Backups are encrypted (AES-256 / AES-GCM). MFA secrets and stored credentials are encrypted in the database. With your own key (BYOK), files and backups are encrypted under a key in your AWS KMS, and revoking it makes them unreadable. |
| Access to your data | Your projects are protected by your access policies and Postgres row-level security. Sovaria staff use a Control Center that needs a device certificate, a password and a one-time code. Staff reach customer data only through audited tools and time-limited support grants, and every staff action is written to a tamper-evident (hash-chained) audit log. |
| Isolation | Each service in the platform uses its own database and cache login with only the access it needs. Your functions run in a gVisor sandbox with no access to other customers, our servers or cloud credentials. |
| Backups | Daily encrypted backups (Backups and recovery). The platform database also has 7-day point-in-time recovery. Every month a backup is restored into a throwaway database automatically, to prove it works. Off-site copies in storage that can't be deleted for 35 days are being switched on. |
| Monitoring | Health, capacity, backups, certificates and error rates are checked every 5 minutes. Problems open an incident and alert the on-call engineer. Service status is on the status page. |
| Secure development | Every change is deployed by one script, which runs smoke tests, rolls back automatically on failure and keeps a record of who changed what. Dependencies are checked for known vulnerabilities every week, container images are scanned when they are built, code is scanned for leaked secrets, and the whole codebase gets regular security audits. What we test and how often: How we secure and test the platform. |
#Where data lives and availability
Sovaria runs on Amazon Web Services. Account data is stored in India (Mumbai). Project data is stored in the region chosen for the project. Production currently runs in a single AWS region, with a single availability zone for the platform database. Point-in-time recovery for project databases and multi-zone redundancy are on the roadmap. We will update this page when they ship.
#Sub-processors
| Provider | What for | Data involved |
|---|---|---|
| Amazon Web Services | Hosting, databases, storage, backups, email (SES) | All project and account data |
| Razorpay, Stripe | Payments | Billing contact and payment references; card details stay with them |
| AI model providers (for example Anthropic, OpenAI, Google) | Sovariq and AI agents, only when you use them | Prompts and the context you or your agent send. Turned off in HIPAA mode. |
| Twilio | SMS one-time codes, only if your project turns SMS sign-in on | Phone numbers, message text |
| Apple (APNs), Google (FCM) | Push notifications, only if you send them | Device tokens and notification payloads |
| GitHub, Google | Sign-in to the console, only if you choose it | Your profile from that provider |
Ask tech@sovaria.in for the current list and the region each provider uses.
#Your part (shared responsibility)
- Keep the service role key on servers; never ship it in an app or commit it (Keys, tokens and credentials).
- Write access policies and row-level security for every table and bucket that holds user data. Security advisor flags gaps.
- Turn on MFA for your console account and require it for your organization.
- Decide which projects hold regulated data, and use HIPAA mode or your own key where needed.
#Security questions and reports
- Security questionnaires, policy summaries and our control map: email tech@sovaria.in (we may ask for an NDA).
- Found a vulnerability? See Reporting a vulnerability.
- Incidents and uptime: the status page.