Zorvetska Limited (“we”, “us”) operates Zorvetiq GovSight AI as a multi-tenant compliance and governance platform. We act as a data processor for the personally identifiable information (PII) our customers place in the platform, and as a data controller for the account information we collect directly. This statement describes the controls we apply, which follow the public-cloud PII protection principles of ISO/IEC 27018.
1. Consent, purpose & ownership (ISO 27018 A.2, A.10)
Customer PII is processed only to deliver the contracted service. We do not use customer PII for advertising or marketing, and we never sell it. Each customer organisation retains full ownership of, and control over, its own data.
2. Data minimisation & the information we hold
We collect the minimum needed to run the service: account identity (name, work email), organisation membership, and the compliance/governance records you create. Product analytics are pseudonymised — we use a non-personal internal identifier and never send email addresses, phone numbers or other direct identifiers to analytics providers.
3. Tenant isolation & access control (ISO 27001 A.5.15, A.8.3)
Every record is bound to a tenant, and each request is scoped to the authenticated user’s tenant so that one organisation can never read or modify another’s data. Access is role-based, credentials are hashed with bcrypt, and authentication attempts are rate-limited to deter brute-force attacks.
4. Encryption & secure processing (ISO 27001 A.8.24, ISO 27017)
All traffic is served over HTTPS with HSTS enforced. Uploaded evidence and documents are stored in access-controlled cloud object storage and served through short-lived, signed URLs rather than public links. Uploaded file names are sanitised to prevent path-traversal.
5. Sub-processors & cloud location (ISO 27018 A.9, A.11)
We use a limited set of reputable cloud sub-processors for hosting, object storage, analytics and payments. Sub-processors are bound by contractual confidentiality and security obligations consistent with this statement.
6. Retention & deletion
Customer data is retained for the life of the account. On verified request or account closure, customer PII is deleted or returned within a reasonable period, subject to any legal retention obligations.
7. Your rights & contacting us
Individuals may request access to, correction of, or deletion of their personal data. Data-protection and security enquiries, including responsible vulnerability disclosure, can be sent to [email protected]. Our vulnerability disclosure policy is published at /.well-known/security.txt.