Purpose

ConveYour protects customer data and the systems that process it through security controls designed to reduce the risk of unauthorized access, disclosure, alteration, loss, or disruption. This page describes the principles and control areas that support that work.

Security program

ConveYour maintains security practices appropriate to the service, the data it processes, and the risks associated with AI-enabled workflows. Security is considered during product design, development, deployment, operation, vendor selection, and incident response.

The company reviews its security practices as its product, customers, data use, and threat environment change.

Identity and access management

ConveYour limits access to customer data, production systems, and internal administrative tools based on job responsibilities and a legitimate business need.

Access management practices include:

• Individual user accounts rather than shared credentials
• Authentication controls appropriate to the system and risk
• Role-based permissions that limit access to the minimum needed
• More restrictive access for sensitive data and production systems
• Prompt removal or adjustment of access when a person's role changes or ends
• Periodic review of privileged and sensitive-system access
• Logging of material administrative and production access activity

Customer access controls

ConveYour provides customers with controls appropriate to the service so they can manage who within their organization may access relevant information and functionality.

Customers are responsible for assigning user access carefully, protecting their own credentials, reviewing access within their organization, and promptly removing access for users who no longer need it.

Protection of data and systems

ConveYour uses safeguards appropriate to the service to protect data in transit and at rest, manage secrets and credentials, secure software development, monitor systems, and address known security issues.