Security & Compliance

Built for institutions that answer to examiners

Your customers’ transaction data is the most sensitive thing you could hand a vendor. We treat it that way: independently audited controls, encryption everywhere, and a paper trail for everything.

Visit our Trust Center See our practices

Certification

SOC 2 Type II, independently audited

Revio Insight holds a SOC 2 Type II attestation — the version examiners take seriously, because it tests that controls operated effectively over time, not just that they existed on audit day. Our audit covers the AICPA Trust Services Criteria for security, availability, and confidentiality. And because an annual audit is a snapshot, our controls are monitored continuously and automatically — evidence is collected from our infrastructure every day, not assembled once a year.

Independent audit against AICPA Trust Services Criteria

Automated, continuous control monitoring across our stack

Audit reports and policies available under NDA via our Trust Center

Vendor and subprocessor reviews as part of the same program

Need the report for your vendor review? Request access at trust.revioinsight.com — we turn those around fast.

Practices

How your data is protected

The controls below are not an enterprise tier — they are how the platform works for every institution.

Encrypted everywhere

TLS for every connection in transit and AES-256 encryption at rest. File delivery runs over SFTP with SSH key-pair authentication — no passwords in flight.

Least-privilege access

Role-based permissions govern every capability — exports, integrations, AI, administration. Users belong to exactly one institution, and access is scoped accordingly.

Everything on the record

AI requests, exports, and API activity are logged with the user, time, and cost. When your auditor asks who accessed what, there is an answer.

AI without data leakage

All AI features run on AWS Bedrock inside our environment. Your data is never used to train models, and every AI call is metered against your institution’s own budget.

Hardened API access

External access uses OAuth 2.1 with MFA and explicit consent, or revocable API keys with CIDR IP allowlists. The AI integration surface is read-only by design.

Resilient by design

Hosted on AWS in the US, defined entirely as code, with automated backups and cross-region disaster recovery. Your data never leaves the United States.

Data handling

Your data in. Nothing out without your say.

Revio is fed by one-way file feeds from your core — we never touch your banking systems directly. What leaves the platform (CSV exports, CRM syncs, printable profiles) leaves because a permissioned user on your team sent it. We do not sell data, share it across customers, or use it for anything but your own analysis.

Talk to us

Bring your security review — we like those

Thirty minutes with the team. Bring your vendor questionnaire, your examiner’s checklist, or just hard questions — walking through our controls is the fastest way to check us out.

The full security architecture, walked end to end

SOC 2 Type II report and policies via the Trust Center

Straight answers — including on what we do not do

Full name *

Work email *

Company / institution *

Phone *

How did you learn about Revio? *

What do you want to see first?

Your message (optional)

We reply within one business day. No newsletters, no drip campaigns.

Message received

We will email you within one business day.