Security & data residency

Built in. Not bolted on.

Your organizational data is walled off by architecture, deployed in the region the law requires, and watched by a security layer that flags sensitive fields the moment they arrive. AVA never shares it with an outside model.

Data residency & EU regulation

Your data lives where the law says it should.

When you register, we verify your location and deploy your tenant in the right region from the very first sync. Organizations outside North America are routed to our EU servers, so EU data stays in the EU. No migration, no checkbox to remember. The routing is the architecture.

You register → location verified at sign-up
US tenant — North American organizations
EU tenant — everyone outside North America

Intelligent routing

Your region is decided at registration and applied to every tenant, sync, and AI operation from day one.

EU data stays in the EU

Tenants outside North America run on our EU servers, aligned with GDPR expectations for where personal data is processed and stored.

No setting to forget

Residency is enforced by where your tenant is deployed, not by a toggle a teammate could flip by accident.

Mithril, the security layer

Sensitive data, spotted the moment it arrives.

When a platform connects, Mithril scans for personal and sensitive information and proposes how to protect it. It begins in shadow mode, logging what it would do, so you review every decision before any masking is enforced.

PII detected automatically

Eight categories of sensitive data, from contact details to financial and medical fields, identified by name and by pattern as data lands.

22 masking techniques

From "show last four" to full redaction and numeric range buckets, with sensible presets for phones, emails, names, and salaries.

Shadow mode first

Watch what would be masked or blocked before anything is enforced. You turn on enforcement when you are ready, not before.

Isolation

A key to your house cannot open your neighbor's.

Every organization gets its own database. Every query touches only your collections. Cross-tenant access is impossible, enforced at both the application and database layer, and AVA is locked to a single organization per conversation.

Credentials are encrypted at rest and scoped to your workspace. They're never shared across tenants, and sensitive values are stripped from results before they ever reach the AI or your screen.

Audit trail

Every access, mask, and decision, on the record.

Security-relevant events are logged with the actor, the context, and a retention window, so you can show an auditor exactly how a piece of data was handled and by whom. Connections, disconnections, and policy changes are kept permanently.

Bring your auditors. We'll show them the architecture.

Walk through residency, isolation, and Mithril on a call, against your real compliance requirements.

ARTIFICIAL = FAKE
Humans lie. Data doesn't.
Welcome to the world's first Organizational Intelligence platform.