IAM-01
Identity and access
Implemented
Authenticated routes, role-based permissions, and owner, admin, member, and viewer boundaries protect workspace access.
Return to Civerent
Public Trust Center
Trust should be inspectable.
Evaluate Civerent's security controls, privacy posture, operational providers, service communications, and current assurance position in one place.
Control posture
Security foundations buyers can evaluate
TEN-02
Tenant isolation
Implemented
Organization-scoped records, row-level security, and ownership validation separate customer workspaces.
EVD-03
Evidence integrity
Implemented
Evidence and activity history preserve accountable records while ordinary users receive limited mutation rights.
DAT-04
Secrets and payments
Implemented
Sensitive credentials remain server-side. Stripe-hosted payment entry keeps full card numbers and CVC data outside Civerent.
SDC-05
Secure delivery
Active process
Typed builds, automated tests, dependency review, and forward-only database changes support controlled releases.
IRP-06
Incident handling
Defined
Potential incidents are investigated, scoped, contained, and communicated when required by applicable obligations.
Assurance status
Clear about what is and is not available
Certification readiness and actual certification are different. This register avoids implying that a third party has issued a report, certification, or government authorization when it has not.
Internal architecture and control verificationActive
Independent SOC 2 reportNot yet available
ISO 27001 certificationNot yet available
FedRAMP or StateRAMP authorizationNot yet available
Customer-specific evidence reviewAvailable by request, subject to confidentiality and verification
Trust resources
One route for diligence and procurement
Legal CenterTerms and procurement documentationSecurity architectureTechnical and operational safeguardsPrivacy PolicyData handling and privacy commitmentsSubprocessorsOperational providers and processing purposesService statusCurrent public notices and status maturityVulnerability disclosureSecurity reporting scope and expectationsResilienceContinuity, recovery, providers, and current limitsData lifecycleRetention, export, deletion, and backup postureData processingProcessing roles and DPA procurement statusResponsible AIProduct principles and customer responsibilitiesAcceptable UsePermitted and prohibited platform useAccessibilityAccessibility posture and feedback channelTermsCommercial terms for using CiverentBilling and refundsSubscription, cancellation, and refund termsCustomer supportSupport scope and contact channelsSupport PolicyCoverage, priorities, escalation, and service limits
Procurement support
Need a security questionnaire or evidence review?
Enterprise and public-sector evaluators can request current documentation. Availability may depend on identity, confidentiality, scope, and the applicable commercial agreement.
Trust Center content is informational and does not constitute a certification, audit opinion, legal advice, or a contractual service level. If a signed customer agreement conflicts with this page, the signed agreement controls.