Trust / 01

Security and data location

Last updated 10 September 2026

EU primary-data residency

Customer scan artifacts and reports are stored in Google Cloud europe-west3 and account, finding and evidence data are stored in Neon's Frankfurt region. Google identifies europe-west3 as Frankfurt in its region directory . Ancillary processors are described separately, including where their edge or support systems operate globally.

Protection

• TLS protects data in transit and provider-managed encryption protects data at rest.
• Tenant-scoped repositories require an organisation identifier for customer queries.
• Runtime services use separate least-privilege identities and Secret Manager.
• The optional monitoring collector sends structure only, rejects unknown payload fields server-side and discards raw snapshots after analysis.
• Private-network and metadata destinations are rejected before and during scans.
• Remediation events form an append-only SHA-256 chain that can be verified and exported.
• Production access is restricted, logged and used only for operational need.

Continuity and retention

Scan jobs use bounded retries and store failure reasons. Nightly integrity monitoring and the production backup recovery configuration remain launch checks; they are not yet an operational service commitment for this pilot. Remediation events are append-only and are not automatically removed when an account closes. Avoid putting personal or sensitive information in evidence notes. Retention and erasure requests require a documented review.

Report a concern

Send a concise description and reproduction steps to contact@thaviq.com. Do not include sensitive data that is unnecessary to demonstrate the issue.