Security Overview
This overview explains how Anvora approaches security, privacy, and data protection for compliance, legal, and governance review.
Contents
Security & Privacy Principles
Anvora is built on foundational principles that guide technical and operational decisions. These principles are not marketing statements, they are constraints that shape how the platform is designed and maintained.
Privacy by design
Privacy controls are integrated into the architecture from the outset, not added retrospectively. Every feature is evaluated for its privacy implications before implementation.
Data minimisation
We collect and retain only the data necessary to provide the service. Session content, metadata, and identity information are handled separately with distinct retention policies.
Least privilege access
Internal systems and personnel access is restricted to the minimum required for operational purposes. Access is role-based, logged, and regularly reviewed.
Purpose limitation
Data collected for a specific purpose is not repurposed. Session data exists to facilitate communication. It is not analysed, profiled, or monetised.
Data Encryption & Storage
Data protection relies on multiple layers of encryption and logical separation. The goal is to limit exposure even in the event of a partial compromise.
Encryption in transit
All data transmitted between clients and our infrastructure is encrypted using TLS 1.3. API communications and real-time messaging use secure WebSocket connections.
Encryption at rest
Stored data is encrypted using AES-256 encryption. Database records, file attachments, and backups are encrypted independently.
Key management
Encryption keys are managed through a dedicated key management service with automatic rotation. Keys are stored separately from encrypted data.
Logical separation
Identity data, session content, and audit logs are stored in logically separated systems. Access to one does not imply access to others.
Note: Specific cryptographic implementations may be updated as standards evolve. This document reflects general approach rather than fixed algorithm choices.
Identity & Anonymity Model
Anvora supports a range of identity configurations, from fully identified participants to pseudonymous access. The model is designed for contexts such as whistleblowing, confidential reporting, or sensitive consultations where identity disclosure must be controlled.
Pseudonymous participation
Participants can engage using system-generated or self-chosen pseudonyms. Real identity is not required for session participation.
Session-scoped identity
Identity context is confined to individual sessions. Participation in one session does not create linkable identifiers across other sessions.
Optional disclosure
Participants control if and when they reveal their identity. Disclosure is explicit, reversible where applicable, and logged for audit purposes.
Data compartmentalisation
Identity verification data, session content, and user account information are stored separately. Correlation requires explicit authorisation and is auditable.
How this works in practice
When a participant joins a session without an account, they receive a pseudonym. Messages they send are associated with this pseudonym, not with any underlying identity. If they later choose to reveal their identity, this action is logged and the association is made explicitly for that session context alone.
This approach supports use cases where initial anonymity is essential for participation, while still allowing for identity disclosure when trust has been established or when required for procedural reasons.
Access Control & Auditability
Governance requirements vary by organisation and jurisdiction. Anvora provides configurable controls for access management, activity logging, and data retention to support diverse compliance needs.
Role-based permissions
Access to sessions, reports, and administrative functions is controlled through configurable roles. Permissions are granular and can be customised per organisation.
Administrative oversight
Organisation administrators can manage team access, review activity summaries, and configure policies. Administrative actions are logged separately.
Activity logging
Security-relevant events are logged with timestamps, actor identification, and action details. Logs are immutable and retained according to organisational policy.
Retention controls
Organisations can configure data retention periods. Automatic expiration and manual deletion are supported with appropriate audit trails.
Activity log contents
Activity logs capture security-relevant events without exposing session content. Logged events include:
- Session creation and closure
- Participant join and leave events
- Identity disclosure actions
- Permission changes
- Data export requests
- Administrative configuration changes
- Authentication events
- Data deletion actions
Compliance Alignment
Anvora is designed to support organisations in meeting their regulatory and governance obligations. The following describes how platform capabilities align with common compliance requirements.
Important: Anvora does not currently hold third-party security certifications such as SOC 2 or ISO 27001. Certification processes are planned as the platform matures. The information below describes design alignment, not certified compliance.
GDPR alignment
- Data minimisation through purpose-limited collection
- Right to access supported through data export
- Right to erasure implemented with configurable retention
- Processing records maintained for accountability
- Data protection by design embedded in architecture
Whistleblowing requirements
- Confidential reporting channels with anonymity options
- Protection of reporter identity through pseudonymous access
- Secure follow-up communication without identity disclosure
- Audit trails for regulatory demonstration
- Configurable retention aligned with investigation timelines
Internal governance
- Role-based access for separation of duties
- Activity logging for oversight and review
- Policy-driven data handling and retention
- Export capabilities for legal and audit requests
- Configurable approval workflows where required
Data processing locations
Production infrastructure is hosted within the European Union. Data processing occurs within EU jurisdictions. For organisations with specific data residency requirements, dedicated infrastructure options may be available upon request.
Operational Security
Security is maintained through a combination of infrastructure controls, development practices, and operational procedures.
Infrastructure
Anvora is hosted on AWS infrastructure within European data centres. We use managed services with established security controls and compliance certifications.
Development practices
Code changes undergo peer review, automated testing, and security scanning before deployment. Dependencies are monitored for known vulnerabilities.
Monitoring
Systems are monitored for availability, performance, and security anomalies. Alerts are triaged by on-call personnel with defined escalation procedures.
Internal access
Production system access is restricted, logged, and requires multi-factor authentication. Access is reviewed quarterly and revoked upon role change.
Incident response
Security incidents are handled according to defined procedures that include:
- DetectionAutomated monitoring and alerting for anomalous activity
- AssessmentSeverity classification and impact analysis
- ContainmentIsolation of affected systems or accounts
- NotificationCommunication to affected parties as required
- RemediationRoot cause analysis and corrective action
Responsible Disclosure & Contact
Security contact
For security-related enquiries or to report a potential vulnerability, please contact:
dataprotection@mallivalabs.comVulnerability disclosure
We welcome responsible disclosure of security vulnerabilities. When reporting, please include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact assessment
- Your contact information for follow-up
Our commitment
- We will acknowledge receipt of vulnerability reports within 3 business days
- We will provide an initial assessment within 10 business days
- We will keep reporters informed of remediation progress
- We will not pursue legal action against good-faith security researchers
General enquiries
For non-security questions about privacy practices, data handling, or compliance documentation:
dataprotection@mallivalabs.com