Aggregate figures only: a note for your risk team

Some teams want to start their AI ROI record in Roiva before their vendor-risk process has reviewed us. Aggregate figures only is for them. It's an account setting, on every plan including the free account. While it's on, the account holds only the figures and text your own people type in, import, or confirm from a Roiva suggestion, with who confirmed each on record. That includes the timings of anyone you give a time study link. Roiva doesn't send any of it to an AI model or to product analytics.

The setting has one option, Allow cost connectors, which is off unless an Owner turns it on. With it on, the account can also connect five billing and usage feeds: AWS, Azure, Google Cloud, Anthropic and OpenAI. Nothing else changes. This page describes the setting both ways.

This page is written so you can hand it to your risk or security team. Everything it says is enforced by the application, not left to a habit.

What the setting does

While it's on:

Nothing can be connected. Roiva refuses to create a connection of any kind, so it syncs nothing from your ERP, card program, AI providers, help desk, CRM or data warehouse. Nothing arrives from Zapier, no card statement is uploaded, and no notification is posted to Slack or Teams. If an Owner allows cost connectors, the five listed under Allow cost connectors below can connect, and every other connection is still refused.
No file is kept. A document behind an initiative is stored as a link to where the file already lives, such as SharePoint or Google Drive, and Roiva keeps the link's title and address. A spreadsheet or CSV someone imports is read and then deleted, and a support ticket can't carry a screenshot.
Nothing goes to an AI model. The Roiva Assistant is off. So is everything else that sends account data to Anthropic, Roiva's AI provider: reading a document to propose an initiative, setting up a new initiative's baselines and formula, estimating the before-figures a template's formulas need from your assessment answers, and template recommendations. A before-figure your answers don't give, you record yourself. Importing a spreadsheet of initiatives uses no AI and still works.
No product analytics. PostHog and Google Analytics receive nothing about the account or the people using it, whatever their cookie choice.

An Owner turns it on or off under Organization Settings → Data Handling. Admins can see the page but not change it.

Allow cost connectors

Cloud and AI-provider bills carry no personal or patient data, and they're often what an AI ROI record most needs. So an Owner can let exactly these five connect while the setting is on:

Connector	What Roiva keeps	Names it keeps
AWS	Daily cost by service from Cost Explorer, for the last 12 months	Service names, your AWS account ID, and the cost-allocation tag key and value an initiative is linked by
Azure	Monthly cost by service from Cost Management, for the last 12 months	Service names, your subscription ID, and the tag key and value an initiative is linked by
Google Cloud	Your budgets, and monthly cost by project and service from your Cloud Billing export in BigQuery	Budget names and each budget's whole filter, including any labels it filters on; the billing account's ID and name
Anthropic	Usage by model and cost by workspace from the Admin API, for the last 12 months	Each cost line's description, workspace IDs and names, model names, and your organization's name in the Anthropic Console, which for a personal organization can be its owner's name
OpenAI	Usage by model and cost by line item and project from the Admin API, for the last 3 months	Line items, project IDs and names, and model names

None of these records is about a person. The names in the third column come from your own cloud and AI-provider accounts, so whether any of it is sensitive is up to you. If your team tags cloud resources with an owner's name or email, pick a different tag to link an initiative by: the value you pick is kept with the link and on the costs it books, and Roiva keeps the tag picker's list of your tag values for up to an hour.

The rest of the setting still holds while they're allowed:

Only these five. It's a fixed list, not a category. OpenAI Codex, Claude Enterprise, your warehouses, help desks, CRMs, card programs, calendars, Zapier, Slack and Teams are all still refused.
Cost and usage only. Anthropic's Claude Code report names each developer by email, so Roiva doesn't ask for it under this setting. Daily Claude Code totals an Anthropic connection synced before the setting went on stay, as totals that name no one. OpenAI's usage is read by model, never by user or API key. No prompt or response is ever read.
Nothing goes to an AI model. The figures these connectors sync are refused to Anthropic's models, like everything else in the account. AI Spend's count of what's AI uses rules and your own answers, not a model.
No product analytics about the account, and no files.
No other server to reach. Roiva sends requests only to each provider's own API addresses, with the key or service account you set up, and a person can't point a connection anywhere else.

To turn it on, an Owner opens Data Handling and chooses Allow cost connectors, or Turn on, allowing cost connectors if the account's only connections are already cost connectors. The audit log records who did it and when, and the account's other Owners and Admins are told. An Owner can turn it off once the account holds no connection and nothing synced from one. Remove the connections on the Integrations page. For figures a removed connection synced, email hello@roiva.ai and we'll remove them. Turning the whole setting off also turns this option off. Turning the setting back on then starts with nothing connected, unless an Owner turns it on allowing cost connectors again.

What an account like this stores

The figures and text your people enter, import, or confirm from a Roiva suggestion. That means initiatives and their descriptions, costs, metric readings and baselines, assumptions, value entries, approvals, budgets and decisions, with any notes people write. You decide what goes in, so you decide whether any of it is sensitive. Most teams enter monthly totals rather than records about individuals.
Who confirmed each suggestion. A template's formulas are there because someone adopted it. Its planned figures are too when someone saw them on the form before saving. Figures Add to initiatives or onboarding copied in one click stay only if someone confirmed them, and while the setting is on those paths leave the figures for a person to enter. What Roiva read from a document into an initiative before the setting went on was confirmed on its review screen, and the audit log names who did it. What Roiva filled in while setting up an initiative, such as planned figures, a template, or a formula or metric its AI wrote, stays only if someone kept it, and the initiative's page, the export and the audit log say who and when.
Document links: a title and an address, not the file.
Time study participants and timings. A participant is either a member of the account or a label someone typed, such as "Agent A". For a person outside the account, Roiva keeps the label, their timings with any task reference they type, and when their link was last opened and how often: no email and no account. The label is a name only if someone types one, or imports one from another tool's export. Like any request to Roiva, opening the link leaves the visitor's IP address in Roiva's server logs. A participant's link is stored only as a digest. Roiva never emails it; whoever runs the study copies it to them. The page it opens loads no analytics, and, like every Roiva page, takes its fonts from Google Fonts. It shows the study's name, task and dates and the account's name, and nothing else in the account. Timings are listed one by one only to the study's owner, and in the account's export.
The people in the account: each member's name and email address, their role, and their sign-in records: when they last signed in and from which IP address. Someone who chooses text-message sign-in codes also leaves a phone number.
Single sign-on, if you set it up: the domains the account has verified, and each identity provider's settings: its sign-in addresses and signing certificate for SAML, or its client ID and client secret for OAuth. The client secret, and the private key for signing SAML requests if you use one, are stored encrypted.
With cost connectors allowed: the bills and usage totals in the table above, and each connection's key, stored encrypted. For Google Cloud, that's the service account Roiva created for the connection.
The audit log: who did what and when, including every change to this setting and its cost connectors. Each initiative's activity feed is the same kind of record, and keeps Roiva's note on how it set up an initiative.

It's kept for as long as the account exists. Deleted data stays in Roiva's encrypted database backups until they expire, thirty days after they're taken. An account export is a ZIP an Owner or Admin downloads, and Roiva deletes it after seven days. If nobody in the account can sign in any more, Roiva staff can generate one on request; that one is kept for thirty days. See Your data: exports and deletion.

Who else sees it

Roiva's sub-processors are listed on the security page. With this setting on, two still handle the account's data:

AWS hosts the application, its database and its files in the United States, and sends Roiva's email and text-message sign-in codes. Notifications and invitations go to members' email addresses, and some name an initiative or a figure.
Sentry receives error reports when something fails: the error, the code that raised it and the page's address, with secrets removed. An error's message can quote a value from the request that failed. When a cost connector's request to its provider fails, Sentry gets only the error's type and the code that raised it, not its message or what led up to it, since those can quote the provider's answer.

Anthropic and PostHog receive nothing from the account while the setting is on. With cost connectors allowed, the five providers you connect are your own vendors, not Roiva's sub-processors. Roiva sends each one the key or service account you set up, the dates it's reading and any tag, label or table you name, and nothing else from the account. That includes Anthropic: reading your own usage through its Admin API sends Anthropic none of your Roiva data, and its models still receive nothing. For Google Cloud, Roiva creates a service account for each connection in Roiva's own Google Cloud project, which you grant read access to your billing. Its description names your Roiva account and connection by number. Stripe holds billing details only for a paid account. On a paid plan, the reporting tables, the weekly export to your own bucket, the read API and MCP send figures only where an Owner or Admin points them.

HubSpot isn't a sub-processor, but it receives a person's name and email if they open the meeting scheduler on the Upgrade page.

The question box on Roiva's public docs pages isn't part of any account. What someone types there is sent to Anthropic to answer it, so it's no place for your figures.

Turning it on

It can be turned on only while the account holds nothing the setting rules out. If the account already has any of the following, Data Handling lists them, and the setting can't go on until they're gone:

Connections, including a disconnected one. If every one is a cost connector, Data Handling offers to turn the setting on with cost connectors allowed, and they stay.
Figures, bills or warehouse query results synced from a connection, including what a removed connection left behind. Ask us at hello@roiva.ai to remove these. Figures from a cost connection that's still connected can stay if you turn it on with cost connectors allowed, but not a removed connection's: Roiva can't tell which platform those came from.
Documents uploaded as files. Replace each one with a link.
Before-figures Roiva's AI estimated while the setting was off, for a template's formulas or a new initiative. Data Handling links to them on Metric Entries: open each and save your own figure over it, or delete it. A figure you save is yours.
Suggestions Roiva made setting up an initiative that no one has confirmed: the planned figures it filled in, the template it adopted, or a formula or metric its AI wrote. Data Handling links to them. Keep as ours makes each the account's own and records who kept it and when; Clear removes it, and the initiative stays. An Owner or Admin can do either. What a document or spreadsheet gave an initiative isn't listed: a person confirmed it on the review screen. Neither is a figure inside an approval's record, which is history and doesn't change.

When it goes on, Roiva deletes its own working copies: files uploaded to create initiatives, the text read out of them, and screenshots on support tickets. The simplest way to start is to turn it on in a new account before anyone adds anything.

The setting applies from the moment it's turned on. It doesn't recall anything sent to an AI model or to analytics before then. An Assistant reply under way at that moment stops at its next request to the model. A Roiva tab someone else already had open stops sending analytics at the next page it opens, though the click and page view that open that page can still be sent.

Checking it

Data Handling shows whether the setting is on, since when, and who turned it on.
Data Handling also shows whether cost connectors are allowed, since when, and who allowed them.
Organization Settings → Audit Log records every time it's turned on or off, every time cost connectors are allowed or stopped, and who did it. The audit log is on every plan, Free included.
Turning it off notifies the account's other Owners and Admins, and tells Roiva. Allowing cost connectors notifies the other Owners and Admins too.

Turning it off

Turn it off once your vendor review has cleared. Connections, file uploads, the Assistant and the other AI features then become available. Nothing already in the account changes.

For a privacy office at a covered entity

Roiva measures with aggregates and doesn't need protected health information (PHI) to work, and it doesn't sign a business associate agreement (BAA) as standard. With this setting on, the account receives nothing from your systems, so whether PHI reaches Roiva depends only on what your people type in or import. With cost connectors allowed, it also receives your cloud and AI-provider bills and usage totals, which name services, models, workspaces, projects, budgets and the tags you choose, but no patient. Keep identifiers out of those names too. A spreadsheet exported from a clinical system is the likeliest way in. Keep entries to totals, such as a month's claim count or hours saved, and keep patient names, record numbers and other identifiers out of notes, descriptions, time study labels and task references, and document titles. An error report to Sentry can quote what someone typed, so this applies to every field. If the work you want to measure would put PHI in Roiva, now or once the setting is off and a system is connected, talk to us at security@roiva.ai first. What Roiva keeps from each platform lists the fields a connection would add.

Roiva's own security

Roiva doesn't have a SOC 2 report yet. Its SOC 2 Type 2 program with Oneleet started on September 25, 2026. The security page says what is in place now and what you can ask for. For a platform connected later, What Roiva keeps from each platform lists the fields it stores.

Building an AI ROI tracker yourself: when a spreadsheet is enough, and where to start instead
Plans and billing: what the free account holds
Sign-in and security: two-factor, single sign-on and the audit log