SOC 2
Our controls have been independently audited, not just documented.
Live
Fleet learning loopEvery stageSee every stage
Enterprise Security
Enterprise-grade security. Verified in real time.
We protect some of the most sensitive data in AI: autonomous vehicle telemetry, proprietary training datasets, and safety-critical annotations. Our security program is SOC 2 Type I certified, continuously monitored, and designed for customers who can't afford breaches.
Enterprise Security
Certifications & Audits
Our security program is independently verified. SOC 2 Type I certified and GDPR compliant today; ISO 27001 in progress. Regular third-party audits prove our controls work, not just that they exist on paper.
GDPR & EU Data Privacy
European customer data is handled according to GDPR requirements.
Live
ISO 27001
Information security management certification in progress.
In progress
ISO 9001
Quality management certification underway.
In progress
Security controls
How we protect your data
Infrastructure Security
- Authentication & Access
- Every person and system accessing Avala infrastructure uses unique credentials. We enforce multi-factor authentication for all remote access, and SSH keys for production systems. No shared accounts, no exceptions. Access follows least-privilege principles: production systems, databases, networks, and encryption keys are restricted to personnel with a documented business need. We review access quarterly and revoke it immediately upon termination.
- Network Security
- Our network is segmented to isolate customer data. Firewalls are configured to deny by default and reviewed annually. We run intrusion detection systems that monitor for anomalies 24/7 and alert our security team to potential breaches.
- Encryption
- All data is encrypted at rest and in transit. Encryption keys are managed with strict access controls: only a small number of authorized personnel can access them, and all access is logged.
People & Processes
- Governance
- Security isn't just an engineering function. It's a board-level priority. Our board receives annual briefings on cybersecurity posture and risk. Management roles and responsibilities for security are formally defined, and we maintain clear reporting lines for security decisions.
- Employee Security
- Every employee signs a confidentiality agreement and code of conduct before starting. Security awareness training is required within 30 days of hire and annually thereafter. Contractors are held to the same standards.
- Asset Management
- We maintain a complete inventory of production assets. When hardware is decommissioned, it's securely wiped or destroyed with certified documentation. Customer data is classified and handled according to its sensitivity level.
How We Stay Secure
- Continuous Testing
- We conduct annual penetration tests and remediate findings according to defined SLAs. Vulnerability scans run continuously, and we perform control self-assessments to verify our defenses work as designed.
- Incident Response
- Our incident response plan is documented, tested annually, and includes clear escalation paths. Security and privacy incidents are logged, investigated, and communicated to affected parties according to regulatory requirements.
- Risk Management
- We assess security risks annually, including environmental, regulatory, and technological threats. Identified risks are rated by severity and addressed with documented mitigation strategies. We carry cybersecurity insurance to limit financial exposure.
- Operations & Resilience
- Disaster recovery and business continuity plans are documented and tested. All production changes go through formal review: authorized, tested, and approved before deployment.
Your Data, Your Control
- Retention & Deletion
- We retain customer data only as long as needed to provide our services. When you leave Avala, your data is purged from our systems according to documented procedures. You can request deletion at any time.
- Classification
- Data is classified by sensitivity and handled accordingly. Confidential information is restricted to authorized personnel and protected with appropriate controls.
- Portability
- You own your data. Export datasets and annotations in standard formats anytime. No lock-in.
- Subprocessors
- We maintain a list of third-party services that process customer data, available on request.
Enterprise Security
Questions about security?
We're happy to walk through our security program, share our SOC 2 report, or complete your security questionnaire. Reach out at security@avala.ai. A real human will respond within one business day.