Trust you can
look into.

Abivian is cloud-native and hosted in Frankfurt, Germany. Our application, database and supporting services run on managed platforms; we operate no servers of our own.

Specialist provider teams handle physical data-centre security, network protection, hardware redundancy and infrastructure patching. Providers processing customer data are bound by data processing agreements, recorded in our sub-processor register and reviewed annually.

Your data belongs to you. We process it only to deliver our services under our data processing agreement; we do not sell it or use it for other purposes.

Customer content is stored in the EU, encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.

Customer environments are logically separated to prevent cross-customer access.

Where a provider processes limited data outside the EU, transfers are protected by Standard Contractual Clauses or the EU–US Data Privacy Framework.

You can export your data in a standard format at any time. When an engagement ends, it remains available for return for 60 days, then is deleted in line with our retention policy.

Abivian supports single sign-on through your identity provider via SAML or OIDC, together with multi-factor authentication, so your access policies can extend to the platform.

Production access follows least privilege and is restricted to a small number of named, senior individuals. Access rights are reviewed periodically; production access and significant platform activity are logged.

Our team uses dedicated, company-managed devices with full-disk encryption. Credentials are held in an encrypted password manager, not in email, chat or source code.

Managed infrastructure provides built-in redundancy. Customer data is backed up daily, encrypted and stored across separate locations, with point-in-time recovery. Automated, around-the-clock monitoring alerts us to abnormal operation.

A documented business continuity plan sets out defined recovery objectives and how service is restored. Service commitments are set out in our service level agreement, available on request.

Source code is held in private, access-controlled repositories. Changes are reviewed before production. The platform undergoes annual independent penetration testing, with identified vulnerabilities prioritised and fixed.

Monitoring connects to a documented incident response plan with defined owners and escalation paths. If a personal data breach affects your data, we notify you without undue delay and within 36 hours, explaining what happened, the impact and our response.

Abivian was founded by a team with senior-level experience in compliance and regulated industries. Everyone signs a confidentiality agreement, undergoes background screening before joining and completes regular security training.

Our security and compliance framework is formally adopted by our Board of Directors and reviewed at least annually. It covers information security, incident response, business continuity, risk management, data classification, retention and privacy, supported by risk and sub-processor registers.

Our contracts include GDPR-aligned data processing terms and DORA-aligned provisions, including audit and access rights. We support ICT third-party risk assessments and provide information for your DORA Register of Information.