Security & Trust Overview

Our security program is led by the CTO (acting as Chief Security Officer–equivalent) with a dedicated security and compliance function. It is aligned with the NIST Cybersecurity Framework, the OWASP Top 10, and CIS Benchmarks. Documented policies cover access control, incident response, vulnerability and patch management, third-party management, data retention, and breach notification, and are reviewed at least annually.

• Content handling. Web pages: for web pages, the Platform remediates through a real-time proxy, processes page content in memory, does not persistently store it, and does notmodify the customer’s source pages or source code. Documents and multimedia: to make Microsoft Office files, PDFs, audio, and video accessible, the Platform accesses and remediates the files themselves and produces remediated versions, handled under the encryption, access control, retention, and deletion controls described on this page.
• Data minimization. We collect only what is needed to deliver accessibility services and do not collect FERPA records, PHI, PCI data, or biometric data.
• Tenant isolation. Multi-tenant data is logically isolated with per-tenant encryption keys and strict cross-tenant access controls; dedicated single-tenant deployment is available.
• Secure deletion. On termination, data is deleted within 90 days by cryptographic erasure.

• In transit: TLS 1.2/1.3 (older protocols disabled), HSTS, and mutual TLS (mTLS) between internal microservices.
• At rest: AES-256 for databases, file storage, and backups.
• Keys: managed in AWS KMS / Google Cloud KMS with hardware security module (HSM) backing (FIPS 140-2 validated), rotated on a scheduled basis, with per-tenant keys and MFA-gated key deletion. Cloud providers cannot access plaintext key material.

• Single sign-on: SAML 2.0 and OpenID Connect (OIDC) for user and administrator authentication.
• MFA: required for all administrative access; available for local accounts.
• Role-based access control with least-privilege roles (Admin, Site Admin, Site Reviewer) and cross-tenant isolation.
• Internal access uses least-privilege IAM, just-in-time elevation, bastion hosts, and quarterly access reviews; credentials and secrets are stored in a managed secrets vault, never in code.

The Platform runs on Amazon Web Services (primary) with Google Cloud Platform for disaster recovery. Both providers maintain SOC 2 Type II, ISO 27001, and FedRAMP authorizations and provide physically secure, 24×7 staffed, environmentally controlled, geographically diverse data centers with redundant power and networking. For U.S. customers, data resides in U.S. regions by default; EU regions are available where required. Infrastructure is defined as code, built from hardened images, and follows an immutable-infrastructure model.

• Static application security testing (SAST) and software composition analysis (SCA) on every build; a software bill of materials (SBOM) is maintained.
• Dynamic application security testing (DAST) weekly; container-image and infrastructure-as-code scanning before deployment.
• A Web Application Firewall (AWS WAF / Google Cloud Armor) protects against the OWASP Top 10.
• Secure software development lifecycle with peer review, secure-coding training, and staged releases.
• Independent third-party penetration testing at least annually (most recently completed June 2026). Summary results are available under NDA, and customers may perform their own testing by arrangement.

We monitor systems 24×7×365 with a SIEM that aggregates logs from all components, automated alerting on anomalies, and cloud-native threat detection. We maintain a documented incident-response plan with defined roles and a 72-hour breach-notification commitment for confirmed breaches of institutional or personal data, followed by a post-incident report. An incident-response team is on call, augmented by external forensics and legal counsel as needed, and we carry cyber-liability insurance.

We maintain documented, at-least-annually-tested business-continuity and disaster-recovery plans, multi-availability-zone and multi-region deployment with automated failover, encrypted daily backups replicated across regions, and monthly restoration testing. Recovery targets are an RTO of under 5 minutes for infrastructure failures and under 1 hour for data corruption.

• Background checks before start for personnel with production access; confidentiality agreements at onboarding; prompt access revocation at offboarding.
• Mandatory security-awareness training at onboarding and annually, plus secure-coding training for engineers.
• All personnel involved in processing institutional data are U.S.-based.
• Sub-processors are assessed and bound by data-processing agreements. See the Sub-processor List.

Connectivo supports customer compliance with FERPA (we do not store education records), CCPA/CPRA (service-provider role; no sale or sharing of personal information), GDPR (DPA with Standard Contractual Clauses, where applicable), and Section 508 / ADA. Our cloud providers hold SOC 2 Type II and ISO 27001; Connectivo does not currently hold its own SOC 2 Type II attestation and may pursue one as the company scales. In the interim, our completed HECVAT, this overview, and independent penetration-test results evidence our security posture.

We welcome responsible disclosure. If you believe you have found a security vulnerability, please email [email protected] with details and steps to reproduce. We will acknowledge your report, investigate, and keep you informed. Please do not access or modify data that is not yours, and give us reasonable time to remediate before public disclosure.