Security

Access control

• Every table containing personal data is protected by row-level security in the database: a user can only read and change their own records, even if an identifier leaks.
• Staff access to the admin console is role-based and logged.
• Sessions use secure, HTTP-only cookies; sign-out is protected against cross-site requests.

Documents

• Uploads are checked for type and size, stored in private storage under your account, and delivered only through short-lived signed links.
• Documents are never public and never used to train AI models.
• You can delete any document, and your whole account, at any time.

Data minimisation towards AI providers

Before text is sent to an AI provider, direct identifiers the model does not need — AHV numbers, IBANs, card numbers, e-mail addresses and phone numbers — are removed. Content from documents and web pages is treated as data and cannot change Civena’s instructions.

Transport and storage

• All connections use TLS. Strict security headers are set on every page.
• Secrets are held server-side only and never shipped to the browser.
• Error logs exclude document content and personal data.

Audit trail

Sensitive actions — account creation, exports, deletions, administrative changes — are recorded in an append-only audit log.

What Civena does not claim

Civena does not currently hold an external security certification such as ISO 27001. We will state certifications here only once they are actually obtained.

Reporting a vulnerability

If you find a security issue, please report it through the contact form with the topic “Technical problem”. Do not include personal data of others.