Secure and private by default

Avrio hosts all its software in Amazon Web Services (AWS) facilities in the EU. We make use of the security products embedded within the AWS ecosystem, including Web Application Firewall, Identity and Access Management, and CloudTrail.
‍
In addition, we deploy our application using containers run on AWS-managed services, meaning we typically do not manage servers or EC2 instances in production.

All team members are trained for security during onboarding and annually refreshed. Access to customer data is limited to authorized team members who require it for operational and maintenance activities only.

Confidentiality agreements are signed by all employees and contractors of the company and background checks are performed for all new team members. 

Avrio conducts application penetration testing by a third-party at least annually in addition to Avrio's continued internal testing and review program.

Avrio also uses high-quality static application security testing provided by Gitlab to secure our product at every step of the development process.

Design of all new product functionality is reviewed for security impact, with Avrio conducting mandatory code reviews for all changes to the code. Avrio development and testing environments are separate from its production environment. All code development is done through a standard process.

All of our production infrastructure is built with redundancies in place, in highly-available configurations spread over three different availability zones in the eu-west-1 AWS region and we have established incident response and disaster recovery plans in place.

All systems access is regularly reviewed and access is granted with the principle of least privilege.

All customer data is encrypted in transit via TLS 1.2 and at rest with AES-256 encryption. We rely on AWS infrastructure to securely maintain our cryptographic encryption keys.

All our services are GDPR & CCPA compliant and we have a transparent privacy and cookie policy available on our site. Data retention procedures are established and we have a data management policy reviewed and accepted by all team members during onboarding.