Legal

Trust Center

Security, privacy, and responsible AI are part of how Grovity builds and operates its platform. This page brings together our policies, the certifications of the infrastructure we run on, and the documentation available to Clients and their auditors.

The Grovity platform runs entirely on Amazon Web Services and other enterprise-grade providers, and inherits the physical, network, and platform controls of their certified environments:

  • ISO/IEC 27001, 27017, 27018
  • SOC 1, SOC 2 Type II, SOC 3
  • PCI DSS Level 1 Service Provider
  • CSA STAR

Clients can verify these certifications independently through AWS Artifact and the trust centers of our providers.

  • Encryption in transit (TLS 1.2+) and at rest (AES-256 with AWS KMS), plus application-level encryption for credentials and tokens.
  • Tenant isolation enforced server-side on every request and knowledge-base query.
  • Access control with individual identities, least privilege, and audit logs.
  • Resilient architecture: serverless core on managed multi-availability-zone services, asynchronous processing with queues, and Infrastructure-as-Code.
  • No card data: Grovity never stores full card numbers; card data is tokenized by PCI DSS-certified processors.
  • No training on your data: Client data is not used to train AI models.
  • Responsible AI: bounded agents, grounding in approved knowledge, human handoff, and full traceability.

Grovity's security program is designed with reference to the SOC 2 Trust Services Criteria, ISO/IEC 27001, the NIST Cybersecurity Framework, and OWASP ASVS, API Security Top 10, and Top 10 for LLM Applications.

Grovity processes personal data in accordance with the GDPR, CCPA/CPRA, Colombian Law 1581 of 2012, the Brazilian LGPD, and the data protection laws of the other countries where our Clients operate. Our Health Data Addendum sets out how the platform can be used in health-related activities.

  • Terms and Conditions
  • Privacy Agreement
  • Data Processing Addendum (DPA)
  • Service Level Agreement (SLA)
  • Acceptable Use Policy
  • Description of the Security of the Services
  • Health Data Addendum
  • Responsible AI
  • Subprocessors

For Clients and prospective Clients in their vendor-risk review:

  • Architecture and data-flow diagrams
  • Security documentation and responses to standard security questionnaires
  • Third-Party Risk Management Policy and program documentation
  • AI governance and algorithmic transparency documentation
  • Business continuity and exit strategy documentation
  • Certifications and reports of infrastructure providers

Request them at security@grovity.ai.