Your marketing data, protected at every step

We support Single Sign-On (SSO) integrations. We also provide 2-factor authentication (2FA) as an additional layer of protection for all user accounts. Role-based access is granted on a least-privilege basis through formalized Joiner/Mover/Leaver workflows, with access rights reviewed at least every 90 days (annually for common access, quarterly for the platform). External access is filtered by a Web Application Firewall and a SASE client connection is required. Key user and admin activity is audit-logged.

SOC 2 Type II: AC2, AC3, AC4, AC7, AC10 · ISO 27001:2022 (SoA): A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, A.8.3, A.8.5 · Governed by: Access Control Policy

The platform uses TLS 1.2/1.3 in transit and AES-256 at rest, with managed, access-restricted key management. Encryption of assets requiring protection is enforced through infrastructure-as-code, and the encryption keys are themselves protected. The governing policy is reviewed at least annually.

SOC 2 Type II: AC8 · ISO 27001:2022 (SoA): A.8.24 · Governed by: Encryption and Key Management Policy

Secure-coding practices, peer code review, and dependency and vulnerability scanning run in the delivery pipeline, including checks of external libraries and detection of unknown or unauthorized components. An automated software validation process runs on every proposed change to the codebase, and all changes follow the change-management workflow: authorization before development, impact evaluation, test documentation, and organizational and technical approval.

SOC 2 Type II: SO1, SO2, CM1, CM2 · ISO 27001:2022 (SoA): A.8.25, A.8.26, A.8.28, A.8.29, A.8.32 · Governed by: Secure Development (SDLC) Policy · Change Management Policy

Continuous vulnerability scanning with automated network and application security tools, annual independent third-party penetration testing, and a HackerOne bug-bounty program. Identified vulnerabilities are automatically escalated, tracked and remediated in a central project-management tool and reviewed in a recurring monthly security jour fixe.

SOC 2 Type II: SO3, SO4 · ISO 27001:2022 (SoA): A.8.8, A.8.29 · Governed by: Management of technical vulnerabilities policy

System, application and security logs are aggregated and analyzed, with metric visualization and alerting. Audit-log metadata is tenant-scoped and retained for the compliance trail. Continuous monitoring automatically prioritizes and escalates security threats to triage, and data-loss-prevention monitors the movement, removal and transmission of data with documented follow-up.

SOC 2 Type II: RA7, AC11 · ISO 27001:2022 (SoA): A.8.15, A.8.16 · Governed by: Security Information and Event Management (SIEM) Architecture and Operations Model

Documented incident-response procedures define communication channels for internal and external parties, analysis and response, escalation, root-cause analysis and lessons learned, with a link to change management for post-incident improvements. Affected customers are notified as soon as possible and no later than 72 hours from when an incident is identified; data-protection incidents are reported to the DPO.

SOC 2 Type II: CI3, CI7 · ISO 27001:2022 (SoA): A.5.24, A.5.25, A.5.26, A.5.27, A.5.28 · Governed by: Security Incident Management Policy and the Incident-specific procedures

Daily encrypted backups with point-in-time restore, supported by redundancy of information-processing facilities. The disaster-recovery plan is tested at least annually with scenario-based drills that are documented and fed into a continuous-improvement process.

SOC 2 Type II: SO5, SO6 · ISO 27001:2022 (SoA): A.8.13, A.8.14 · Governed by: Business Continuity and Disaster Recovery Policy and Backup Policy

Controlled deletion and retention aligned to legal requirements, including procedures to identify and securely render or remove data on equipment to be disposed of and to wipe non-compliant or off-boarded devices. A Record of Processing Activities (ROPA) is maintained for GDPR, and data masking is applied where appropriate. Retention specifics are in section 03.

SOC 2 Type II: AC9, CI2 · ISO 27001:2022 (SoA): A.8.10, A.8.11, A.5.33, A.5.34 · Governed by: Data Retention & Deletion Policy

Background checks, ID verification and CV validation at onboarding, signed confidentiality agreements, and new-hire orientation covering information security, privacy, anti-harassment and anti-corruption. All staff complete annual security training and phishing simulations and attest to the security policies; a disciplinary process applies to violations.

SOC 2 Type II: CE6, CI5, CI6 · ISO 27001:2022 (SoA): A.6.1, A.6.2, A.6.3, A.6.6 · Governed by: End User Policy

Sub-processors are vetted through risk-based vendor assessments, DPA-bound, and held to equivalent standards. Contracts include NDAs, DPAs and defined service levels, with a documented termination / off-boarding workflow. Each subservice organization’s SOC 2 Type II report (AWS, Google Cloud, Microsoft Azure, Snowflake, OpenAI) is reviewed at least annually.

SOC 2 Type II: RA3, RM1, CSOC1 · ISO 27001:2022 (SoA): A.5.19, A.5.20, A.5.21, A.5.22, A.5.23 · Governed by: Supplier Security Policy

Business continuity management covers the full BCDR lifecycle: definitions for crisis, emergency and disruption; a continuity strategy with planning, implementation and evaluation guidelines; and scenario-based recovery procedures with defined recovery objectives (RPO/RTO). A Business Impact Analysis across internal and external data sources is performed at least annually, hosting is designed for redundancy, and plans are tested at least annually with documented, continuously improved results.

SOC 2 Type II: SO5, SO6, CI1 · ISO 27001:2022 (SoA): A.5.29, A.5.30, A.8.14 · Governed by: Business Continuity and Disaster Recovery Policy

Adverity is ISO/IEC 27001 certified, which is the international standard for information security management systems (ISMS). We are also SOC 2 Type 2 audited, ensuring our internal controls for security, availability, and confidentiality meet rigorous industry benchmarks.

Yes, Adverity complies with the EU General Data Protection Regulation (GDPR) and UK GDPR requirements. We prioritize data privacy and offer features like data masking and granular access controls to help our customers meet their own regional compliance requirements (including CCPA).

All data fetched through Adverity is transferred via fully protected API connections using SSL/TLS protocols to ensure integrity. Once inside our platform, all processed data assets are encrypted at rest using industry-standard encryption algorithms to prevent unauthorized access.

Our secure cloud infrastructure is designed for high reliability, maintaining service availability levels above 99.9%. We provide real-time monitoring and proactive status updates to ensure your data pipelines remain operational.

The Adverity platform can be hosted on Amazon Web Services, Microsoft Azure, or Google Cloud, and is managed by Adverity. Additionally, you have the option to host your data within your own Snowflake or Google BigQuery warehouses. For any specific hosting requirements, please speak to your sales manager about alternative options.

Yes. To simplify user management and enhance security, we support Single Sign-On (SSO) integrations. We also provide 2-factor authentication (2FA) as an additional layer of protection for all user accounts.

To help customers meet data sovereignty requirements under UK and EU law, Adverity allows you to choose where your data is stored. We offer hosting in secure facilities in both the European Union and the United States, and we can support configurations that keep data within your own local infrastructure.

Adverity follows the "principle of least privilege." Administrators can set granular permissions at the individual or user-group level, ensuring that team members only have access to the specific data streams, workspaces, and sub-accounts required for their roles.

We take a proactive approach to security through:

• Annual Penetration Testing: Rigorous assessments conducted by independent security experts.
• Continuous Scanning: Advanced tools that monitor our network for misconfigurations or programming flaws.
• Bug Bounty Program: Collaboration with global security researchers via HackerOne to identify and resolve potential issues responsibly.

No. Adverity’s built-in AI tools are designed for data transformation and insights. Our agreement with third-party providers (like OpenAI) ensures that no customer data processed through the platform is used for training their public models. Customers also have the option to connect their own private AI provider accounts, if preferred. For more details, see our Data Processing FAQ