Security You Can Rely On
We hold ourselves to a high standard so your data is always protected. Here's an open view of our security posture, certifications, and the partners we work with.
Our Commitment to Security
Security isn't a checkbox — it's built into how we design, operate, and improve Evari.
At Evari we believe that trust is earned through transparency and action. Our information security programme is designed to protect the confidentiality, integrity, and availability of all data we handle — whether that's your assistant configurations, team data, or conversation history. We hold ISO 27001 certification and operate under a formal Information Security Management System (ISMS) that is independently audited every year.
Independently Verified
Our certifications are issued and renewed through accredited third-party auditors, not self-assessments.
ISO/IEC 27001 is the internationally recognised standard for information security management. Certification requires a comprehensive ISMS covering risk assessment, security controls, and continuous improvement — audited annually by an accredited certification body.
- Formal Information Security Management System (ISMS)
- Annual third-party surveillance audits
- Risk assessment and treatment framework
- Covers design, development, and operation of the Evari platform
- Mandatory employee security training and awareness
Evari is operated by Evari Services UK Ltd, a UK-registered company. We comply fully with the UK GDPR and EU GDPR, and handle personal information in line with the Australian Privacy Principles and the New Zealand Privacy Act 2020. A Data Processing Agreement (DPA) is available to all customers and forms part of our standard Terms of Service.
- Data Processing Agreement available on request
- Lawful basis documented for all processing activities
- Data Subject Rights (access, deletion, portability) supported
- Records of Processing Activities (RoPA) maintained
- 72-hour breach notification process in place
How We Protect Your Data
Our controls span physical, technical, and organisational layers — all mapped to the ISO 27001 Annex A control set.
Strict access governance ensures only authorised personnel can reach sensitive systems and data.
- Role-based access control (RBAC) across all systems
- Multi-factor authentication enforced for all staff
- Least-privilege principle applied by default
- Access reviews conducted quarterly
All customer data is encrypted in transit and at rest using industry-standard algorithms.
- TLS 1.2 or higher for all data in transit
- AES-256 encryption for all data at rest
- Encryption keys managed via Google Cloud KMS
- HTTPS enforced with HSTS preloading
Continuous monitoring detects anomalies and security events before they become incidents.
- Centralised security logging and SIEM alerting
- Automated anomaly detection on key systems
- Audit trails retained for all privileged actions
- Uptime and availability monitoring 24/7
We proactively find and fix vulnerabilities before they can be exploited.
- Dependency scanning on every code merge
- Regular penetration testing by third parties
- Responsible disclosure programme in place
- Critical patches applied within 24 hours
A documented and rehearsed incident response plan minimises the impact of any security event.
- Formal Incident Response Plan reviewed annually
- Defined severity classifications and escalation paths
- Customer breach notification within 72 hours
- Post-incident reviews and lessons learned
Regular backups and tested recovery procedures protect against data loss.
- Automated daily backups of all customer data
- Geographically redundant backup storage
- Recovery Time Objective (RTO) tested quarterly
- Business continuity plan maintained
Security awareness is embedded into how our team works — from day one.
- Security awareness training on joining and annually
- Acceptable use and confidentiality agreements
- Phishing simulation exercises conducted regularly
- Background checks for all new hires
Security is integrated into every stage of our software development lifecycle.
- Mandatory code review before production merges
- OWASP Top 10 considered in design and review
- Staging environment mirrors production
- Infrastructure-as-code with change control
Your Data, Your Rights
We collect only what we need, retain it only as long as necessary, and make it easy for you to exercise your rights.
A Data Processing Agreement (DPA) is included within our Terms of Service and governs how we process personal data on your behalf. Enterprise customers can request a countersigned copy.
- Included in standard Terms of Service
- Defines controller / processor responsibilities
- Covers sub-processor obligations
- Signed copies available on request
We retain your data only for as long as your account is active or as required to fulfil legal obligations. Conversation and assistant data is deleted on account closure.
- Account data deleted within 30 days of closure
- Billing records retained for 7 years (legal requirement)
- Log data retained for 90 days
- Backups purged within 35 days of deletion
Under the UK / EU GDPR, the Australian Privacy Principles and the New Zealand Privacy Act 2020 you have a number of rights we are committed to upholding. Contact us at privacy@evari.tech to exercise any of these.
- Right to access your personal data
- Right to erasure ("right to be forgotten")
- Right to data portability
- Right to rectification of inaccurate data
We use cookies on our marketing website to measure traffic and improve the experience. You can manage your preferences at any time via our cookie banner. No behavioural advertising cookies are used.
- Cookie consent collected before any analytics
- Google Analytics used for website traffic only
- No cross-site tracking or advertising pixels
- Preferences can be updated at any time
How Your Data Is Handled
What your assistants send to AI models, how we treat personal information, and where your data is stored and processed.
To respond, your assistants send the content of each request to an AI model provider: your instructions, the relevant conversation, and any files or records the task uses. Providers process it under a data processing agreement and do not use it to train their models.
- Never used to train AI models
- Business API services only, never consumer AI products
- OpenAI response storage switched off on every request
- Providers may keep requests for 30–55 days solely for abuse monitoring, then delete them
We process personal information on your behalf and on your instructions. It reaches an AI model only as part of the content your assistants are working with, and it is never sold or used for advertising.
- Processed only on your instructions, as your processor
- Logically isolated per account, never shared between customers
- You control what data your assistants can access
- Human approval steps available before assistants take action
Accounts registered in Australia or New Zealand are hosted on our Australian infrastructure in Sydney (Google Cloud australia-southeast1). Your account’s records, files and activity data are stored there.
- Account data stored in Sydney, Australia
- Australian-hosted AI models available on request
- AI requests are processed in the model provider’s region
- Some platform services, including search indexing, run from the UK
| Data | Australian & NZ accounts | All other accounts |
|---|---|---|
| Account data Records, files and activity |
Australia (Sydney) | United Kingdom (London) |
| Platform services Assistant runtime, session state and search index |
United Kingdom (London) | United Kingdom (London) |
| AI model processing See sub-processors below |
Model provider’s region, mainly United States; Australian-hosted models on request | Model provider’s region, mainly United States |
International transfers are covered by Standard Contractual Clauses and documented Transfer Impact Assessments. We never sell personal data to third parties.
Third-Party Sub-processors
These are the companies we use to deliver the Evari service. Each has a data processing agreement in place with us and is subject to our vendor security review.
| Provider | Purpose | Category | Location |
|---|---|---|---|
Claude
Anthropic, PBC
|
AI model processing — one of the models assistants use to respond and reason. Not used for training. | AI Model | United States |
Gemini
Google LLC
|
AI model processing — one of the models assistants use to respond and reason, and to index content for search. Not used for training. | AI Model | United States |
|
OpenAI
OpenAI, L.L.C.
|
AI model processing — one of the models assistants use to respond and reason, and to index content for search. Response storage is switched off. Not used for training. | AI Model | United States |
|
SCX
Southern Cross AI
|
AI model processing — Australian-hosted models available to assistants, and a fallback for search indexing. Not used for training. | AI Model | Australia; selected models in the United States and Singapore |
Google Cloud Platform
Google LLC
|
Cloud infrastructure, compute, database, storage, and hosting for the Evari platform. | Infrastructure | UK (London); Australia (Sydney) for Australian & NZ accounts |
Stripe
Stripe, Inc.
|
Payment processing and subscription billing. Card data is handled exclusively by Stripe and never touches our servers. | Payments | United States |
Google Analytics
Google LLC
|
Website traffic analytics and usage measurement on the evari.tech marketing website. Only activated with cookie consent. | Analytics | United States |
Have a Security Question?
Our security team is happy to answer questions, provide documentation, or discuss our controls in more depth.