Security
Your trust is the foundation
of everything we build
We build security software, so we hold ourselves to the highest standard. Here's how we protect your data and earn your trust.
Our Approach
Security is not a feature.
It's how we operate.
Defence in depth
We implement multiple overlapping layers of security controls - from network segmentation and firewalls to application-level protections and runtime monitoring.
Zero-trust architecture
Every request is authenticated and authorised, regardless of origin. We enforce least-privilege access across all systems with continuous verification.
Verified continuously
Automated vulnerability scanning runs on every build and daily across the fleet. We run our own security program on the same platform we sell you, so our posture is managed the way we tell you to manage yours.
Transparent incident response
Documented response plan with a 24-hour customer notification SLA. Post-incident reviews with root cause analysis shared openly.
How We Protect Your Data
Defence-in-depth across
every layer
Data Encryption
AES-256 encryption at rest and TLS 1.3 for all data in transit. Customer-managed encryption keys available for enterprise plans.
Infrastructure Security
Hardened cloud infrastructure with network segmentation, WAF, and DDoS protection. Immutable infrastructure via automated pipelines.
Access Controls
Role-based access with least-privilege enforcement. MFA required, single sign-on with your identity provider, and comprehensive audit logs for every action.
Continuous Monitoring
24/7 infrastructure and application monitoring with real-time alerting. Automated vulnerability scanning on every deployment.
Incident Response
Documented response plan with 24-hour notification SLA. Post-incident reviews with root cause analysis. Dedicated security team on call.
Secure Development
Security embedded in every SDLC stage. Mandatory code reviews, static analysis, dependency scanning, and pre-deployment security checks.
Our Commitments
Promises we keep,
not just make.
We never sell or share your data with third parties
All employee devices are managed and encrypted
Background checks for all team members with data access
Regular security awareness training for every employee
Responsible disclosure program for security researchers
Automated vulnerability scanning on every build and daily across the fleet
Data processing agreements available for all customers
Get started
See how Alvor works
for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.