Security

Draft, not legal advice This page is a structural scaffold produced during the site rebuild. It has not been drafted or reviewed by a lawyer. Every marked block below needs text from a Singapore-qualified adviser before this page is published. Do not rely on it and do not put it live as it stands.

Where we actually stand

We would rather be plain about this than impressive. Below is what is true today, and what is not yet.

We do not hold SOC 2. Type II is a target, not a certification we have. Anyone telling you otherwise, including anyone from us, is wrong.

Where your data sits

Calls and chats are handled on the customer's own Microsoft Azure instance. Content can be stored in Singapore.

Needs engineeringConfirm which regions are available per channel, whether any component processes outside the chosen region, and whether the customer's own Azure tenancy is the default or an option. Do not publish a residency claim that has not been confirmed for voice, for each messaging channel, and for logs.

Retention and deletion

The customer organisation sets how long call and message content is kept. Content is deleted on that schedule.

Needs engineeringState the configurable range, the default, whether deletion is hard or soft, and how long backups hold deleted content.

Encryption

Needs engineeringState encryption in transit and at rest, the algorithms and key management. Leave this section empty rather than guessing: an unverified encryption claim is one of the fastest ways to fail a security review.

Access control

Needs engineeringInternal access model, least privilege, authentication for staff, logging of administrative access, and how customer support access is granted and revoked.

Callers are told at the start of the call that it is being recorded. We provide the customer organisation with that wording.

The PDPA notice covers this in more detail.

Certifications

SOC 2 Type II: in progress. Not held.

AISE is on the IMDA Productivity Solutions Grant pre-approved list, which is a funding eligibility assessment, not a security certification. We will not present it as one.

Needs an ownerList any certification actually held, with the issuing body and the valid-to date. If the list is empty, say so plainly. Do not list a framework the company merely aligns to as though it were certified.

Reporting a vulnerability

If you have found a security issue, write to security@aivo.asia. Please give us a reasonable window to fix it before disclosing it publicly.

Needs an ownerConfirm the mailbox exists and is monitored, and add the response commitment and safe harbour wording. A published security address that nobody reads is worse than none.