Security and data handling

Your data is held in New Zealand

Aiva runs on infrastructure located in New Zealand. Your customer records, conversations and order history are stored here, under New Zealand law, and are not moved offshore for processing.

Encrypted at rest and in transit

Data is encrypted where it is stored, using full-volume encryption with keys that are not held alongside the data. Everything travelling between your store, your browser and our systems is encrypted in transit as a matter of course.

Backups leave the country encrypted, and stay unreadable

We keep off-site backups, because a business that cannot recover from a failure is not looking after your data either. Those backups are encrypted before they leave New Zealand, using a method where the destination cannot decrypt them and neither can the server that produced them. The key that opens them is held separately, offline, by a named person in New Zealand.

In practice that means a backup copy may sit on storage outside New Zealand, but it is ciphertext. Nobody at the storage provider, and nobody who gained access to our servers, could read it. We would rather describe that accurately than claim your data never leaves the country.

Least access, and an audit trail

Systems and people get the narrowest access that lets them do the job, and no more. Automated components read broadly but write narrowly, through approved paths only. Actions that touch a customer record are logged, including what informed them and who approved them.

Aiva does not act unsupervised where it matters

Aiva answers enquiries on its own, because that is the point of it. It does not make the consequential decisions by itself. Anything involving money, a commitment on your behalf, or a message you would want to see first is drafted for your approval rather than sent. You decide where that line sits for your business.

What we do not do

• We do not sell your data, or your customers’ data, to anyone.
• We do not use your customers’ conversations to train models for other businesses.
• We do not share your data with other Aiva customers. Each business is kept separate.
• We do not send marketing to your customers without a lawful basis for doing so.

If something goes wrong

If we become aware of a breach affecting your data, we will tell you promptly, tell you what we know, and tell you what we are doing about it. Where the Privacy Act 2020 requires notification to the Office of the Privacy Commissioner, we will make it.

Getting your data out, or deleted

It is your data. Ask and we will export it in a usable format. Ask us to delete it and we will, subject to any records we are legally required to keep. Deletion reaches our backups as those backups age out on their normal retention cycle.

Questions from your own security review

If your organisation runs a vendor security assessment, send it to us. We would rather answer a specific question properly than publish a detailed description of our internal architecture, which would mostly be useful to people probing it.