Skip to content
Talk to usBook a demo

Security

Signed in. Scoped. Logged.

Every person signs in with a second factor, sees only the pages and teams they are given, and every AI answer is recorded. This page lists what is implemented, as it works today.

No certification such as SOC 2 or ISO 27001 is claimed. We share this list and can arrange a review with your security team.

Your cloud project

Your sourcesAds, CRM, stores, ecommerce, sheets
Your warehouseAgreed rules and checked releases

Dedicated Hivora instance

HivoraRoles, page permissions, team scope
PeopleInvite, 2FA, sessions
AI clientsSecure sign-in, totals only, logged
Data boundary: sources and the warehouse stay in your project, and each client has a dedicated instance. Nothing is pooled across clients.

Controls

Eight controls, all implemented.

  1. 01

    Invite-only access

    Accounts start from an invitation. There is no open sign-up.

  2. 02

    Two-factor, always

    An authenticator app or passkey is required before any page opens.

  3. 03

    Roles and page permissions

    Owner, admin, manager and member roles, with each page granted separately.

  4. 04

    Team scope

    Team leads and members see only their own team's budgets, checked twice.

  5. 05

    Session control

    A role change or revoked access ends every active session for that person.

  6. 06

    Personal data on a named list

    Customer contact details open only for named people, with export limits and alerts.

  7. 07

    Audited AI access

    Every AI question is recorded with who asked it and what was answered.

  8. 08

    Limits and bot checks

    Repeated sign-in attempts are blocked, and automated bots are kept out.

In practice

Who sees what. And a record of every AI call.

Pick a role to see how one example deployment opens up, then see what the audit log keeps when people ask in ChatGPT.

Example grant · one deployment5 of 6 areas open
  • Performance marketingPage granted
  • Budget and spendOwn teams
  • CRM campaignsOwn brands
  • Customer intelligencePage granted
  • Customer contact detailsNot granted
  • Manage accessMembers only
Full Scoped Named people Closed
AI tool audit logIllustrative
TimeRoleTool and scopeResult
09:14ManagerBudget reportKSAAnswered · totals only
09:22MemberCRM summaryEmailAnswered · totals only
09:31MemberCustomer groupsAllRefused · page not granted
10:02AdminSpend reportAll teamsAnswered · totals only
10:05ManagerCustomer groupsContact listRefused · no contact details in AI
Each call records who asked, which tool answered and what was returned. Example rows with fictional usage.

Access lifecycle

From invitation to exit.

  1. Step 1

    Invitation

    An owner or admin invites a work email and sets the role and pages.

  2. Step 2

    Verification

    The person verifies their email before the account opens.

  3. Step 3

    Second factor

    An authenticator app or passkey is set up before the first page loads.

  4. Step 4

    Scoped work

    Pages, teams and personal data follow what was granted, in the app and in AI tools.

  5. Step 5

    Change or exit

    Changing a role or revoking access ends every session at once.

Bring your security questions.

We will walk your IT and data team through the controls, the data boundary and the deployment.

Book a review