TOVIA
English
Apply for founding access

Type to search. Legal placeholders and the admin are not indexed.

In development · founding partners onboarding from Q4 2026

Security & trust

What we do, what we don’t yet, and what we will never claim.

TOVIA is pre-launch. This page says exactly where the platform stands on security today, in the words a technical reviewer would use — no badges we do not hold.

Apply for founding accessEmail the team

Certification status

Current status: not certified.

TOVIA holds no ISO 27001 certification and no SOC 2 report. Not "in progress", not "aligned" — none.

Controls implemented
Listed below, each with the state it is actually in.
Roadmap
SOC 2 Type I or ISO 27001, targeted after the first paying customers. Quarter to be published. [to complete]
What we will never write
"ISO-aligned" or "enterprise-grade". Those are not claims, they are adjectives.

The control inventory

Twelve items, each with a state.

  1. 01

    Hosting

    Planned

    The application is EU-hosted; the provider and region are named at launch. [to complete] The site you are reading is served from Cloudflare's edge — that is this website, not the platform, and they are separate systems.

  2. 02

    Encryption

    In development

    TLS 1.2+ in transit, with HSTS on this site today. AES-256 at rest on the application's database and backups is a design commitment, verified at launch rather than claimed now.

  3. 03

    Tenant isolation

    Built

    Shared database, shared schema, mandatory tenant scoping on every query, and no global fallback path. Row-level security is part of the platform contract. Stated precisely because technical buyers check this one.

  4. 04

    Access control

    In development

    MFA for all operators and role-based access. Production access is limited to one named person today, and it is logged — with one person, saying so is more useful than describing a process.

  5. 05

    Backups and recovery

    In development

    Daily backups, with a stated RPO of 24 hours. RTO will be published after the first restore test [to complete]; a restore is tested before any promotion. An untested backup is not a backup.

  6. 06

    Audit logging

    In development

    Activity, audit and readiness are designed as separate records, retained separately: who changed what, when, and from where. Keeping them apart is what makes an audit trail survive a bug in the feature it records. The contract exists and parts of it are implemented; complete coverage across the platform does not.

  7. 07

    Secure development

    In development

    Code review on every change, continuous integration on every pull request, and no real data in non-production environments — which is why every screenshot on this site is synthetic. Automated dependency scanning [to complete] and a managed secrets vault [to complete] are not in place yet; secrets are kept out of the repository by review and by ignore rules, which is a weaker control and is stated as one.

  8. 08

    Incident process

    In development

    A published security address [to complete] and customer notification aligned to GDPR Art. 33's 72 hours, including the processor's duty under Art. 33(2) to notify the controller without undue delay.

  9. 09

    Sub-processors

    Planned

    A published list, with changes announced and an opportunity to object. [to complete] The initial list — hosting, email, form and analytics providers — is confirmed before the first customer loads data.

  10. 10

    Data processing agreement

    In development

    Available on request today, downloadable before the first customer loads data. It is a document, not a checkbox on a signup flow that does not exist yet.

  11. 11

    Data export and switching

    In development

    A full, machine-readable export of your tenant on request; self-service export is being built. The EU Data Act requires it, and we would rather be the vendor you could leave than the one you cannot.

  12. 12

    Responsible disclosure

    Planned

    A /.well-known/security.txt file and a published disclosure policy. No bounty programme yet — announcing one we could not fund would be worse than not having one.

Verify it yourself

What a reviewer can check today, without asking us.

  • This site's response headers: a hash-pinned Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy and a restrictive Permissions-Policy. Every inline script is hashed at build time and the build fails if one is not.
  • The public changelog and roadmap — what shipped, when, and what has not.
  • The engineering practices described on the roadmap: code review on every change, additive migrations, evidence per release.

Ask the awkward questions early.

Send the security questionnaire before the call rather than after it. Where the answer is “not yet”, you will get “not yet”.

Apply for founding accessEmail the team