Trust at Ceven
Security you can verify, not just trust.
Ceven processes procurement contracts, employment records, and payment metadata for every customer on the platform. The controls below describe how we protect that data, how we respond when something goes wrong, and where we are on the road to independent certification. Every control is reviewed on change and at least annually.
Certification status
SOC 2 Type I
In progressPolicy docs complete; independent audit scheduled
SOC 2 Type II
PlannedPost-Type I; requires 6-month observation window
GDPR compliance
In placeData subject rights and processor agreements in place
CCPA compliance
In placeCalifornia resident rights honored per statute
HIPAA
PlannedBAA framework ready; activated when PHI enters scope
Infrastructure security
Protecting the network, servers, and data stores that Ceven runs on.
Organizational security
How people access and work with Ceven's systems.
Product security
Controls baked into how the software is built and shipped.
Internal security procedures
Policies, responsibilities, and response playbooks.
Data and privacy
What we collect, how long we keep it, and how we delete it.
What we collect
The minimum fields required to operate the platform, grouped by purpose. The full retention policy lives in our Privacy Policy.
Subprocessors
Third parties that process customer data on Ceven's behalf. We require every subprocessor to sign a data processing agreement and meet the controls in our vendor management policy.
Responsible disclosure
If you find a security issue, report it to security@ceven.io. We acknowledge every report within two business days and fix critical issues the same day. Give us reasonable time to investigate before disclosing publicly.
Contact
Security questions: security@ceven.io. Compliance documentation requests: compliance@ceven.io. Privacy and data subject requests: privacy@ceven.io.