Built for the controls enterprise teams require
Roiva holds your initiatives, the credentials for the systems you connect, and what it syncs from them: totals, and records trimmed to the fields it needs. We treat all of it with the controls a finance team would expect.
Pillars
What we do, end to end
Encryption
TLS 1.2+ for data in transit. AES-256 at rest for sensitive credentials. Database backups are encrypted at rest.
Authentication
Email + password with rate-limiting. Optional 2FA via authenticator app or SMS. SSO and SAML on every plan, the free account included.
Authorization
Every request from your team needs an active membership in your account and can reach only your account's records, plus Roiva's read-only shared library of metrics and formulas. Access ends as soon as a member is removed or suspended. Role policies gate account settings, approvals, finance close and integration management. Fixed roles per account: Owner, Admin, and Member.
Audit log
Account-scoped audit trail of authentication, role changes, integration connections, value approvals, MCP tool calls, document opens, and admin actions. On every plan, the free account included.
AI providers
Anthropic Claude powers the in-app assistant, initiative estimates, template recommendations and document analysis. Your data is never used to train their models. See AI transparency below.
Hosting
Hosted on AWS in the United States. Application and background workers run in isolated containers on a single host, administered over a private network. Every uploaded file is scanned for malware on arrival, and one found to contain malware is never delivered.
Your systems' data
What Roiva keeps from the systems you connect
A sync reads the records it needs, such as tickets, deals or bills, and saves only the fields the reference below lists for each kind. The rest is dropped, never stored: a ticket's subject and messages, a contact's email or phone, a customer's address, a calendar event's title and attendee emails. Roiva never reads a prompt or a response from an AI provider. From Snowflake, Databricks and BigQuery it reads billing and usage views, and from them and SQL Server your own data only through the metric queries you write, against the views you grant it for them. From those it keeps only a month, a value, an optional breakdown such as line of business, and a sample size.
What it keeps can still identify people, and the reference says where: deal and opportunity names, customer names on invoices and Stripe charges, free text such as a line description or an issue summary, and people by the platform's own ID. In your account, Owners and Admins can open synced records, as can a finance reviewer an Admin names — inside a month's finance evidence packet, not through the connection pages.
Roiva's figures leave only where an Owner or Admin sends them. The reporting tables, a nightly Parquet copy for Power BI or your data warehouse, are read with a token that can read nothing else, or written to an S3 bucket you own through a role you create that can only add files to one folder, never read, list or delete. Roiva never writes into your warehouse. Every build, read and delivery is in the audit log.
It's kept while your account is, not on a schedule. Deleting a connection deletes its records, except a bill an allocation rule split, and deleting the account deletes everything. Database backups are kept for 30 days.
Health data and HIPAA
Roiva measures with aggregates, such as a month's ticket count or spend, and doesn't need protected health information (PHI) to work. Roiva doesn't sign a business associate agreement (BAA) as standard.
A sync drops a ticket's subject and messages before anything is saved. Some fields it keeps are names or free text, though, and could carry PHI if a covered entity connected the system behind them. Among them are deal and opportunity names, the customer on an invoice or a Stripe charge, the payee on a payment, line descriptions, ticket tags, issue summaries, and the values a warehouse metric query breaks a figure down by. So could anything your people type, import or upload. What Roiva keeps from each platform lists every field.
If a use would put PHI in Roiva, talk to us at security@roiva.ai before connecting anything.
Vendor review not finished yet? An account can start with Aggregate figures only, which holds only the figures your people type, import, or confirm from a Roiva suggestion, and sends no data to an AI model. It can't be connected to anything, unless an Owner allows cost connectors for your cloud and AI-provider bills.
Continuity
What you keep if Roiva goes away
Roiva is a young company, and your AI ROI record shouldn't depend on it. If Roiva stopped running, you'd keep the copies you had already taken out, so here is what they hold.
The reporting tables (included on every paid plan) can put every approved figure in your own warehouse or S3 bucket each night, with who approved it and when. A calculated figure comes with the formula version and expression it was computed with, the inputs frozen with it, and the readings and baselines behind them. Costs, budgets, locked months and portfolio decisions come with them. They're typed tables with a published schema, and once loaded they're yours to query without Roiva.
The full-account export, on every plan, adds what the tables leave out: value entries in every status, every assumption the account has set, the audit log, and the uploaded documents themselves. An Owner or Admin downloads it when they choose, or has Roiva write it to the same bucket every week, and every Owner is told when that's turned on.
Neither copy holds Roiva's software, the defaults in its shared library beyond the values your figures used, or a formula's changes from before October 2, 2026, beyond the expression recorded with each figure.
AI specifically
How we treat your data when AI is involved
Sub-processors
Who else touches your data
The same list published in section 5 of the privacy policy, which is the authoritative version.
| Sub-processor | Purpose | Data location |
|---|---|---|
| AWS | Application hosting, database, file storage, job queue, outbound email, text-message sign-in codes | United States |
| Stripe | Payments and subscription billing | United States / EU |
| Sentry | Application error monitoring | United States |
| Anthropic | Assistant inference, initiative estimates, template recommendations, document analysis, report commentary drafts | United States |
| PostHog | Product and usage analytics | United States |
Also receives personal data, for Roiva's own purposes
These process no customer data under the DPA, and the DPA says so. They hold data Roiva collects as controller: people who book a demo, take the public assessment or join the newsletter, and consented marketing-site analytics.
| Service | Purpose | Data location |
|---|---|---|
| HubSpot | Demo scheduling and assessment lead contact records | United States |
| Google Analytics 4 | Marketing-site analytics, consent-gated | United States |
Reporting a vulnerability
Found a security issue? Tell us first.
Email security@roiva.ai with a description of the issue and the steps to reproduce it.
This covers roiva.ai, app.roiva.ai and Roiva's integrations, including the Roiva app for Slack.
- We acknowledge every report within one business day.
- We aim to ship a fix or mitigation for high-severity issues within seven calendar days.
- Please give us the chance to fix an issue before you disclose it publicly.
Compliance
Compliance and security reviews
Roiva's SOC 2 Type 2 program with Oneleet started on September 25, 2026. The examination covers the Security criteria of the AICPA Trust Services Criteria and includes a three-month observation period, which started on October 21, 2026. The report will be issued by an independent CPA firm from Oneleet's partner network after the observation period ends, and Oneleet manages the audit.
The same engagement includes a manual penetration test of the Roiva application every year, by an OSCE-certified tester working from the OWASP Top 10, ASVS and WSTG, with each finding retested once it's fixed.
The first test took place from October 8 to October 15, 2026, against Roiva's staging environment. Oneleet's Letter of Attestation, dated October 26, 2026, states that no critical or high risk vulnerabilities were found and that no findings remain unresolved.
Request our policies and reports through the Roiva Trust Center, which Oneleet hosts. Documents are added there as they're ready, including the penetration test letter and, when it's issued, the SOC 2 report.
There is no SOC 2 report yet; it follows the end of the observation period. Until it exists, write to us for Oneleet's engagement letter, its penetration test Letter of Attestation, a security questionnaire, a vendor risk review, or our latest sub-processor list, and we'll respond within one business day. Which fields Roiva keeps from each system you connect is published, platform by platform, in What Roiva keeps from each platform.
security@roiva.ai