Trust
Security at Prava AI
How SwiftSafe protects the data you entrust to Prava AI, how we test that protection, and a dated record of our audits, tests and security updates.
Practices
How we protect customer data
A security platform holds some of the most sensitive data an enterprise has. We strictly follow global compliance regulations (GDPR, DPDP Act and national frameworks worldwide without fail), process data in local data centres without foreign storage, secure our servers and applications regularly, and continuously monitor our systems, logs, applications, employees and third parties to protect and strengthen security.
01
Global compliance adherence
We strictly follow all data protection and cybersecurity regulations worldwide—including the EU/UK GDPR, India's DPDP Act, and regional laws across the Americas, APAC and Middle East—respecting each country's regulatory mandates without fail.
02
Local data centres & residency
We use local regional data centres to process and store your data within your own country or region without storing in foreign countries. Processing, telemetry and AI model training remain strictly sovereign within that local zone.
03
Encryption & tenant isolation
Data is encrypted in transit with TLS and at rest with strong AES-256 encryption. Each customer's data is logically segregated by tenant across queries, storage and the assistant's retrieval pipeline, preventing cross-tenant access.
04
Server & application hardening
We secure and harden our servers and applications regularly. Infrastructure configurations, operating system baselines and application code undergo routine patching, automated dependency scanning and security hardening.
05
Continuous systems & log monitoring
We centrally monitor systems, audit logs, cloud workloads and applications 24/7. System and administrative activity logs are protected against tampering and reviewed continuously to detect anomalies and strengthen resilience.
06
Employee & personnel security
Staff access follows strict least privilege and mandatory multi-factor authentication (MFA). Employees undergo background screening where legally permitted, sign confidentiality deeds, and complete continuous security and privacy training.
07
Third-party & supply-chain security
All third-party vendors, sub-processors and cloud suppliers undergo rigorous security and compliance assessments before onboarding, with ongoing monitoring to secure and strengthen our end-to-end supply chain.
08
Vulnerability management
We scan our infrastructure and dependencies continuously, triage findings by severity and exposure, and remediate them against defined targets. External reports are handled through our responsible disclosure process.
09
Continuity and recovery
Encrypted backups are kept in the same local region as the data they protect, and tested through regular restore drills. Business continuity and disaster recovery plans are documented and exercised periodically.
10
Secure development lifecycle
Code changes are peer-reviewed and pass automated security pipelines, including secret scanning and SAST/DAST, before release. Security requirements and threat modelling are embedded from initial design.
11
Autonomous-action safeguards
You decide, per action and asset, whether Prava AI acts automatically, asks first, or only recommends. High-impact containment actions require approval by default, and critical systems can be excluded.
12
Incident response & transparency
Our documented incident response plan features 24/7 SOC escalation. If a personal data incident affects your tenant, we notify you within 24 to 48 hours with full forensic details and mitigation support.
Product
Product security
Prava AI runs on your endpoints, reads your telemetry and can act on your systems. Each of those parts is built with that responsibility in mind.
Agent
The endpoint Agent
The Agent connects outbound only, over TLS, to your regional endpoint. Its packages are signed, it is protected against tampering, and it updates through a controlled release process that you can stage.
Model
The AI model
Prava AI uses SwiftSafe's own LLM and detection models. They are red-teamed for prompt injection, memorisation and data leakage, and the assistant retrieves context only from your tenant. Data use is set out in the AI and Data Use Policy.
Actions
Autonomous-action safeguards
You decide, per action and asset, whether Prava AI acts, asks first or only recommends. High-impact actions need approval by default, critical systems can be excluded, every action is logged with its evidence, and containment can be reversed.
Assurance
Assurance programme
The planned cadence of the checks we run on ourselves. Each completed activity is recorded in the log below.
| Activity | Frequency | Performed by | Latest |
|---|---|---|---|
| Internal security audit | Annually | SwiftSafe security team | [Date of latest internal audit] |
| Independent penetration test | Annually, and after major changes | Independent third-party testers | [Date of latest penetration test] |
| Vulnerability scanning | Continuous, with weekly review | SwiftSafe security team (automated) | [Date of latest scan review] |
| Access review | Quarterly | System owners and security team | [Date of latest access review] |
| Backup restore and DR exercise | Annually | SwiftSafe engineering | [Date of latest DR exercise] |
Record
Audit and security update log
A dated record of audits, tests, security updates and advisories, newest first.
9 Nov 2026
Policy
Published legal, privacy and compliance documentation
We published our Terms, Privacy Notice, Data Processing Addendum, AI and Data Use Policy, compliance overview and related documents. See the legal centre.
[Date]
Audit
[Entry template: audit title]
[Summary: scope, who performed it, outcome and follow-up]
[Date]
Pen test
[Entry template: penetration test title]
[Summary: scope, tester type, findings by severity and remediation status]
[Date]
Update
[Entry template: security update title]
[Summary: what changed and whether customers need to act]
[Date]
Advisory
[Entry template: advisory title]
[Summary: issue, affected versions, impact and recommended action]
Note. We add an entry when an audit or test is completed, when we ship a security-relevant change, and when we issue an advisory. Entries are summaries. Customers and prospective customers can request summaries of audit and penetration test reports under a non-disclosure agreement by writing to security@prava.dev.
Status
Certification status
SwiftSafe does not hold any security certification or attestation yet. Our practices are designed to align with ISO/IEC 27001 and SOC 2, and we will record any future audit or certification in the log above.
Our compliance page explains how Prava AI is designed to support customers' own regulatory obligations, and where things stand today.
Response
Incident response and status communication
We keep a documented incident response plan with defined roles, severity levels and escalation paths. It is reviewed after every significant incident and exercised regularly.
To report an active incident affecting your Prava AI environment, contact our security operations team at soc@prava.dev, available 24/7.
If a personal data breach affects your data, we notify your security and administrative contacts without undue delay, and in any event within 24 to 48 hours after confirming it, with an early warning where a shorter regulatory deadline may apply. The full terms are in section 12 of the Data Processing Addendum.
Research
Responsible disclosure
If you believe you have found a vulnerability in Prava AI or our websites, please tell us at security@prava.dev. A person reads every report. Scope, safe-harbour terms and what to expect from us are set out in our responsible disclosure policy.
FAQ
Security questions
Is Prava AI certified to ISO/IEC 27001 or SOC 2?
No. We hold no certifications yet. Our practices are designed to align with both frameworks, and any future audit will appear in the log on this page. See compliance.
Which compliance regulations does Prava follow?
We strictly follow global data protection and security regulations—including the General Data Protection Regulation (GDPR) in the EU and UK, the Digital Personal Data Protection Act (DPDP Act) in India, and respect all countries' regularities worldwide without fail. See our Compliance overview for complete regulatory details.
Where is our data stored and processed?
Exclusively in local data centres within your own country or region, set at onboarding or in your Order Form, without storing your data in foreign countries. Processing, telemetry, backups and any AI model training on your data strictly remain within that local sovereign zone.
How do you secure servers, applications, and monitor employees and third parties?
We secure and harden our servers and applications regularly through continuous patch management, secure development practices (SAST/DAST), and configuration baselines. Our systems, infrastructure and audit logs are monitored 24/7. Employee access is governed by strict least privilege and mandatory MFA, and all third-party vendors and sub-processors undergo rigorous, continuous security assessments to strengthen supply-chain defense.
Is our data used to train your models?
It may be, under the safeguards in our AI and Data Use Policy, including de-identification and removal of secrets. Enterprise customers can restrict or opt out of training through an Order Form or DPA.
Can Prava AI take actions on our systems without approval?
Only if you allow it. You choose, per action and asset, whether Prava AI acts automatically, asks first or only recommends. High-impact actions require approval by default.
Can we see your penetration test results?
Summaries of audit and penetration test reports are available to customers and prospective customers under a non-disclosure agreement. Write to security@prava.dev.
Can we complete a security questionnaire with you?
Yes. Send it to hello@prava.dev and we will route it to the security team.
Next step
Ask us about security
Talk to us about your review, request report summaries under NDA, or send us your questionnaire.