Security & Trust
The controls we have, stated plainly.
Arvia holds commercial and financial data, so we describe our controls precisely.
Access
Who can see and do what.
Roles and permissions
Four role templates plus custom roles, built from more than a hundred individual permissions.
Sign-in
Sign in with a password or a Google or Microsoft work account. Sign-in is protected by a captcha and rate limiting.
Organisation separation
Every request is scoped to the organisation the user belongs to, and users who work for several organisations switch between them explicitly.
API keys
The public API is read-only. Keys are limited to named scopes, can expire and can be revoked.
Audit
A record of what happened.
Tamper-evident approval history
Approval decisions are recorded in a hash-chained history, so any alteration to past entries can be detected.
Approval controls
People can’t approve their own spend, and a relevant change to an approved item sends it back for approval.
Project change history
Changes to project details are logged with who made them and when.
Finance checks
Nightly integrity and reconciliation checks between Arvia and Xero, and optional finance period locks that stop changes to closed periods.
AI
Ask Arvia stays inside your permissions.
Off by default
Ask Arvia is switched on by an administrator; until then it does nothing.
Same permissions as the user
It can only read data the person asking is already allowed to see.
Human confirmation
It can prepare changes, but nothing is saved until a person reviews and confirms them.
Figures from Arvia
Amounts and totals come from Arvia’s own calculations, not from the AI model.
Platform
How the service is protected.
Encrypted Xero credentials
Your Xero connection and other credentials are stored encrypted (AES-256-GCM).
HTTPS and security headers
All traffic is served over HTTPS, with HSTS, a content security policy and other standard security headers.
Rate limiting
Sign-in, the application and the public API are rate limited.
Monitoring
Application errors are monitored so problems are seen and fixed quickly.
Dependency and secret scanning
Code changes are automatically scanned for vulnerable dependencies and accidentally committed secrets.
Assurance
Certifications and sign-in.
Formal certification, starting with Cyber Essentials, is on our roadmap. If your procurement process includes a security questionnaire, we’re happy to complete it. Sign in with your Google or Microsoft account, and your organisation’s own multi-factor authentication and sign-in policies apply. Each organisation’s data is kept separate, with access checked on every request.
For questions about hosting, sub-processors or data protection, email privacy@arvia-erp.com.
Doing due diligence?
Book a demo and bring your security questions. We’ll answer them directly.