Privacy Policy

Last Updated: July 21, 2026

Aevesa ("we," "our," or "us") protects the privacy and security of information entrusted to us by customers, evaluators, and visitors. This Privacy Policy describes how we collect, use, retain, and safeguard information when you use our agentic evidence platform, verification portal, and related websites.

1. Data We Collect

Depending on how you interact with Aevesa, we may process:

• Account information: Name, email address, organization, billing contact, and authentication credentials for app.aevesa.com and related dashboards.
• Technical data: IP addresses, browser type, device identifiers, request logs, and security telemetry needed to operate, secure, and debug the Service.
• Governance and receipt metadata: Agent session identifiers, tool/route names, policy decisions, risk scores, HITL outcomes, gateway attest fields (such as gateway_decision_id and cryptographic hashes), ledger anchors, and export-pack metadata used to produce audit evidence.
• Integration payloads you configure: When you connect webhooks, GRC sinks (for example ServiceNow or Jira), Slack/Teams, or third-party AI gateways, we process the data you route through those integrations according to your configuration.
• Support and sales communications: Messages you send to team@aevesa.com, sales@aevesa.com, or through briefing forms.
• Evaluation and lead forms: Work email, organization, role, and product-interest fields you submit on aevesa.com (for example briefing, Evidence Gap, or enterprise forms). When you later use a related demo with the same email, we may record product-attach stage signals to measure evaluation progress. These signals update an existing lead record only; anonymous demos do not create account records by themselves.

2. Verification Portal (verify.aevesa.com)

The public verification portal is designed for privacy-preserving audit checks:

• No account required for basic offline verification workflows.
• Client-side verification: Where supported, receipt JSON you paste may be validated in your browser without storing full payloads on our servers.
• Shared receipt links: If you use ?receipt_id= or similar share features, we load the receipt data necessary to display verification results.
• Your responsibility: Do not paste production secrets or personal data into public verification unless you intend to disclose them.

3. Data Minimization and Verification Design

Aevesa is built to support evidence-grade governance without exporting raw prompts or tool payloads to public verifiers by default. We prioritize cryptographic digests, policy references, ledger anchors, and redacted receipt fields for audit workflows. Customer-configured exports may include additional fields according to your tier and settings.

Customer data is not used to train third-party foundation models. Processing is scoped to providing the Service for your tenant.

4. Security Logs and Audit Trail

We maintain security and operational logs to protect accounts and detect abuse, including authentication events, failed access attempts, MFA events, API usage, and suspicious patterns. Governance ledger entries and signed receipts are designed to be tamper-evident for compliance review.

5. Data Security

We use industry-standard safeguards, including TLS 1.2+ in transit and AES-256 encryption at rest where applicable. No method of transmission or storage is completely secure; we continuously improve our controls as the Service evolves.

6. Third-Party Processors and Integrations

We use established subprocessors to operate the Service, including:

• Payments: Stripe processes payments; Aevesa does not store full payment card numbers.
• Infrastructure: Cloud hosting providers with SOC 2 Type II Ready or equivalent attestations where applicable.
• Customer-chosen integrations: When you connect external systems (gateways, GRC tools, chat platforms, identity providers), data flows according to your configuration and those vendors' privacy terms.

7. Data Retention

We retain information for as long as needed to provide the Service, meet contractual retention settings for your tier, resolve disputes, and comply with legal obligations. Sandbox and evaluation data may be deleted on a shorter schedule. Enterprise customers may have custom retention and deletion terms in an order form.

8. Your Rights (GDPR / UK GDPR / CCPA)

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing. California residents may also have rights to know, delete, correct, and opt out of sale/sharing as defined under CCPA/CPRA. Aevesa does not sell personal information.

To exercise privacy rights, contact team@aevesa.com. We will respond within the timeframe required by applicable law (typically 30-45 days).

California Privacy Rights (CCPA/CPRA)

California residents may request disclosure of categories of personal information collected, sources, purposes, and recipients, and may request deletion or correction subject to legal exceptions. Submit requests to the contact address above.

9. International Transfers

Aevesa is headquartered in the United States. If you access the Service from other regions, your information may be processed in the U.S. or other locations where we or our subprocessors operate, with appropriate safeguards where required.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the Last Updated date above.