Your records stay yours.

Your records are kept separate from every other company’s at the database level. Every table in Pivora’s database has a rule that returns only the records of the company asking, and the app connects with a restricted login that cannot get around those rules.

A second check stops and reports any attempt to show one company a record that belongs to another.

Each role opens only the parts of Pivora it needs. Prices and amounts are shown only to roles allowed to see money. Everyone else works with quantities, and sees “Not available to you” where a price would be. People always see the amounts on requests they raised, and approvers see the figures on what they are deciding.

Every record shows who made it and when, and records of materials show where: the store, road or landmark. Corrections and cancellations stay in the history with who made them and why, instead of being deleted. Changes to roles, permissions, approvals and money are written to an audit log.

Every night, a full copy of the database is encrypted with AES-256 and stored separately from the servers that run Pivora. The last 30 nightly copies are kept.

Pivora’s application and its database run on servers in Europe: the database in Amsterdam and the web servers in Frankfurt.

Two features rely on outside services. When you ask Pivora AI a question, the question and the records needed to answer it are sent to our AI provider, Anthropic. Site Guy’s messages travel through WhatsApp, which is run by Meta.

The people who run Pivora see facts about the service, such as how many users and projects your company has and when it was last used. They don’t see your records, your amounts or your staff’s names.

To read your records, they need support access. Your Owner switches it on in Settings for between 1 and 72 hours, and can end it at any time. If your service is failing and can’t wait, a member of Pivora’s staff can open emergency access for up to 4 hours, after writing down the reason. Every Owner is told at once, in the app and by email.

Support access is read-only. Staff can’t sign in as your users, approve requests, move money or change records. Every session, and every page read during it, is logged permanently, and your Owners can see that log in Settings.

Your Owner can download all of your company’s records as spreadsheet files at any time. If a company is deleted, its records are kept for 30 days so the deletion can be undone, and then destroyed.

If you think you’ve found a security problem in Pivora, email hello@pivoratech.io with what you found and how. Please don’t access other companies’ records or disrupt the service while looking.