Our approach

Alvio Group Limited handles sensitive financial data, so security is built into how we design and run the platform. This page summarises the technical and organisational measures we apply; they evolve as the platform and the threat landscape change.

Hosting and infrastructure

The platform runs on reputable cloud infrastructure providers that maintain recognised security certifications (such as ISO 27001 and SOC 2) for their facilities. Production systems are logically separated from development and test environments.

Encryption

Data is encrypted in transit using TLS and encrypted at rest using strong, industry-standard algorithms. Secrets and credentials are stored in managed secret stores, not in source code.

Tenant isolation and access control

Each customer’s data is logically isolated and access is scoped to the authenticated tenant. Internally we apply least-privilege access: staff access to production data is restricted, role-based, logged, and granted only where needed to operate or support the Service. Administrative access requires multi-factor authentication.

Monitoring and logging

We maintain audit logs of significant actions and monitor systems for errors and suspicious activity. Logs support security investigation, accountability and troubleshooting.

Vulnerability management

We keep dependencies up to date, apply security patches, and use automated checks in our development pipeline. We periodically review and test the security of the platform and engage independent testing as our programme matures.

Sub-processors

We use a vetted set of sub-processors (for hosting, database, AI inference, email, payments, analytics and error monitoring), each under contracts requiring appropriate security and data-protection safeguards. Our current list is available on request and in our Data Processing terms.

Incident response and breach notification

We maintain an incident-response process to detect, contain and remediate security incidents. Where we act as a processor and become aware of a personal-data breach, we notify the affected controller without undue delay so they can meet their obligations under the UK GDPR and the Data Protection Act 2018. Where we are the controller, we notify the Information Commissioner's Office (ICO) and affected individuals where the law requires.

Resilience and backups

We take regular encrypted backups and design for resilience so the Service can be recovered in the event of failure. We test recovery procedures periodically.

Certifications

We align our practices to recognised frameworks and are progressing a formal compliance programme. Where formal certification or attestation is in progress rather than complete, we will say so rather than overstate our status.

Responsible disclosure

If you believe you have found a security vulnerability, please report it to info@alvio.io marked for the attention of the Security Team. We welcome good-faith reports and will not pursue researchers who act responsibly and avoid harm to data or service availability.