Company · Security
Built around control.
How Avesta handles access, isolation, approvals and auditability.
Tenant isolation
Every record belongs to an organization. Isolation is enforced at the database level with row-level security policies, not by application code that could be bypassed.
Access control
Roles are stored separately from user profiles and evaluated server-side. Permissions apply per organization, office, team and role.
- Role-based access control
- Server-side authorization on every protected operation
- Scoped, revocable integration permissions
AI governance
AI actions are classified. Read-only analysis runs freely; anything that would reach a client is held as a proposal until a human approves it. Every proposal and decision is recorded.
- Action classification
- Human approval gates
- Append-only audit history
- Data provenance retained with each signal
What we do not claim
Avesta does not currently claim SOC 2, ISO 27001 or any other certification. When a certification is obtained, it will be published here with its report date and scope — and not before.