Security

Security is not an afterthought at Eleva - it is built into every layer of our platform. We take the protection of your business data seriously and continuously improve our security posture.

This page describes the technical and organizational measures we have in place to protect your data.

Hosting: Eleva is hosted on a globally distributed cloud infrastructure with automatic HTTPS, DDoS protection, and 99.9%+ uptime.

Database: Your data is stored on a SOC 2 Type II certified database platform running on AWS. This provides:

• Isolated database instances per project
• Point-in-time recovery (PITR)
• Automated daily backups with 30-day retention
• EU and US regional data storage options

Data in transit: All communication between your browser and Eleva is encrypted using TLS 1.2+ (HTTPS). We enforce HTTPS across all endpoints and use HSTS to prevent downgrade attacks.

Data at rest: All data stored in our database is encrypted at rest using AES-256 - the same standard used by financial institutions and government agencies.

Passwords: User passwords are hashed using bcrypt with a high work factor. We never store plain-text passwords.

Authentication: User authentication supports:

• Email + password authentication with secure session management
• JWT-based access tokens with short expiry
• Refresh token rotation

Row-Level Security (RLS): Row-level security policies ensure that each user can only access their own data - enforced at the database level, not just in application code.

Internal access: Eleva team member access to infrastructure is controlled by multi-factor authentication (MFA) and principle of least privilege.

• Input validation: User inputs are validated and sanitized as a defence against common injection attacks (SQL injection, XSS, etc.)
• Dependency management: We regularly audit and update dependencies to address known vulnerabilities
• API rate limiting: Our underlying infrastructure and AI provider enforce rate limits to reduce abuse
• HTTPS enforcement: All traffic is served exclusively over HTTPS; plain HTTP requests are redirected

When you use Eleva's AI features, your content (documents, queries, contract text) is transmitted to our AI processing provider for processing.

• Data is transmitted over encrypted TLS connections
• Our AI provider does not use API inputs to train their models - see Anthropic's usage policy
• We do not permanently store the full content of AI conversations beyond your active session (chat history stored locally, not on server)
• Our AI provider's security practices: anthropic.com/security

Magic Inbox and other automated ingestion sources introduce content from outside Eleva, so we treat it as untrusted by default:

• Document and email content is only ever used as data for extraction - it is never treated as an instruction to our AI systems, which mitigates prompt-injection attempts embedded in a forwarded document (e.g., text designed to manipulate automated processing)
• Extraction output is validated against a strict schema before it can reach your records; downstream AI features only see validated structured data, not raw document text
• Senders are checked against your known contacts; content from unverified senders is always held for your manual review, never auto-committed
• Attachment size and file-type limits apply, and we run standard spam/malware filtering on inbound content before processing

We operate a responsible disclosure program. If you discover a security vulnerability in Eleva, please report it to us before public disclosure:

Email: security@appeleva.com

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact

We commit to:

• Acknowledge your report within 48 hours
• Provide a status update within 7 days
• Resolve confirmed vulnerabilities within 30 days (or communicate a timeline for complex issues)

We will not take legal action against researchers who follow responsible disclosure practices.

In the event of a security incident affecting your data:

• We will investigate and contain the incident immediately
• Affected users will be notified within 72 hours of discovery, as required by applicable data protection law
• We will provide clear information about what happened, what data was affected, and what actions we are taking
• Post-incident, we will conduct a root cause analysis and implement improvements

• Data protection regulations - compliant with applicable laws including GDPR (EU/EEA) and KVKK (Turkey), with privacy-by-design principles applied globally
• SOC 2 Type II - our database provider is independently audited
• SOC 2 - our hosting provider maintains security certifications

We continuously work toward improving our compliance posture as the platform scales.

For security-related questions or to report a vulnerability:

Email: security@appeleva.com