Trust Center
What runs today, what's designed, and what we don't have.
This page is for whoever has to fill in the security questionnaire. It describes how Tvameva works as of 8 October 2026: what runs today, what the platform is designed to do but doesn't run yet, what we don't have, and who processes data on this website. When something moves from the second list to the first, this page changes with it.
What runs today
Today the systems we run in production are this website and the services behind it. Every statement in this section is true of them now, as written.
Encrypted at rest
Data we store on Google Cloud is encrypted at rest using Google-managed keys.
Credentials kept in a secret store
The private keys and tokens this site uses are held in Google Secret Manager, not in its code.
Pinned dependencies
Every build installs exact dependency versions from a committed lock file.
Reviewed before release
Before a release of this site goes live, it gets a security review and a full automated test run, and a named person approves it.
Releases can be rolled back
A release of this website can be rolled back to the previous version.
Encrypted in transit
Pages on this site are served over HTTPS, and its servers use TLS for every connection that carries your data to the services listed below.
When we get it wrong
When something goes wrong, we write up what happened and change the rule that allowed it.
Designed, not yet running
The platform is built on Google Cloud today.
The statements below describe how it's designed to work. None of them runs for a customer yet, so read them as design, not as controls in place. Each one moves to "What runs today" when it does.
Your content in your cloud
The platform is designed so your content stays in your own cloud environment.
Designed for your own account
The platform is designed to run inside your own cloud account.
Your sign-in
The platform is designed to sign your people in through your own identity provider, with single sign-on.
Every request in scope
Each request is designed to be checked against the customer it belongs to and the role of the person making it.
A named person for the irreversible
An action that can't be undone is designed to wait for a named person to approve it.
Rules designed only to tighten
The rules are designed so a business team can make them stricter, never looser.
What we don't have
Tvameva holds no SOC 2 or ISO 27001 certification today. If that changes, this page changes first.
Who processes data on this website
These services process visitor data on tvameva.ai, as of 8 October 2026.
Google Cloud
Hosting, server logs, and Vertex AI, which runs the AI model behind the home-page breakout and its search.
Google Workspace
Emails each form submission to our team, and a short confirmation to you.
Google Analytics
Site analytics: pages viewed, device, approximate location, and cookies.
Google Fonts
Web fonts, which receive your IP address and browser details on each page load.
Algolia
Site search: the words you type into the search box, and your IP address.
Apollo.io
Our contact list: the name, email and company you give on the contact form. Careers applications don't go to Apollo.io.
Our content system
Page content, contact and careers form submissions, and a private copy of what visitors type on the home page.
Calendly
Demo booking. You leave our site for Calendly's, and only what you enter there goes to them.
Questions this page doesn't answer?
Ask us. We'd rather tell you what we don't have than leave you guessing.