Encryption
All data processed and stored by Angelva is encrypted in transit and at rest using
modern cryptographic standards, including TLS 1.3 for all communications and AES-256
for data at rest. Encryption keys are managed through a dedicated key management service
with strict separation of duties and automated rotation policies. Database-level encryption,
storage volume encryption, and application-layer field-level encryption are applied in
multiple layers to ensure data remains protected even in the event of infrastructure-level
compromise or physical media theft.
Access Controls
Role-based access control (RBAC), mandatory multi-factor authentication (MFA),
just-in-time privileged access provisioning, and granular permission scoping ensure
that only authorized individuals access the right data at the right time for the right
reason. All internal access to customer environments and investigation data is logged,
attributed, and subject to continuous automated anomaly detection. We enforce a strict
least-privilege model across all engineering, operations, and support functions, and
conduct quarterly access reviews to identify and remove unnecessary permissions before
they can be exploited.
Operational Security
Our operational security program includes continuous internal threat monitoring,
quarterly external penetration testing conducted by independent security firms,
annual red team exercises, and isolated workload execution environments that prevent
cross-tenant contamination. We maintain a formal vulnerability disclosure program,
a coordinated patch management process with defined SLA windows for critical findings,
and a documented incident response plan that is tested regularly through tabletop exercises.
Security incidents affecting Angelva's own infrastructure are investigated using the
same forensic rigor we apply to customer engagements, and affected customers are
notified promptly per our contractual and regulatory obligations.
Compliance
Angelva is built to satisfy the requirements of SOC 2 Type II, GDPR, ISO 27001,
CCPA, HIPAA (as a Business Associate where applicable), and other regulatory and
compliance frameworks required by modern enterprise customers. Our compliance program
is maintained by a dedicated team, validated through annual third-party audits, and
continuously updated as regulatory requirements evolve. SOC 2 Type II reports, ISO 27001
certification details, trust service criteria mappings, and supporting compliance
documentation are available to customers and qualified prospects under NDA upon request.
