Security

Enterprise-grade by design.

Published SOC 2 Type II report, GDPR framework, ISO 27001 in progress. Your content is not used to train general-purpose or cross-customer models. Isolated workspaces, roles and permissions, dedicated SSO on Enterprise; our team answers security questionnaires and DPO reviews.

Privacy policy Last verified: 26 September 2026 · the Trust Center, the DPA and the contract prevail
Last verified · 26 September 2026
Security & trust

Enterprise-grade security and compliance

SOC 2 Type IIGDPRISO 27001 in progressNo training on your data

Secure by design: customer data is never used to train models, and intellectual property remains fully with the customer. SOC 2 Type II · GDPR · encryption in transit and at rest · access controls · logs. ISO 27001 in progress.

How does Aive protect its customers’ content?

Aive publishes a SOC 2 Type II report and operates within a GDPR framework; the ISO 27001 process is under way. Under Aive’s policy, customer content, inputs, outputs and personal data are not used to train general-purpose or cross-customer models. Encryption, access controls and logs are described on the Trust Center; the DPA and the contract set out processing, location, retention and service levels.

SOC 2 Type II
An independent audit report on the design and operation of security controls over a given period.
DPA
A data processing agreement setting out roles, documented instructions and safeguards under the GDPR.
No cross-customer training
A commitment that one customer’s data is not used to train models serving other customers.
Published wording

What we state, word for word.

This is the wording Aive publishes. It never goes beyond its source.

What we state, word for word.
TopicPublished wordingWhere to verify
SOC 2Aive publishes a SOC 2 Type II report; see the Trust Center for its scope.Trust Center
ISO 27001ISO 27001 process under way.Trust Center
GDPRGDPR framework; the DPA and the contract define the processing.Privacy policy, DPA
No trainingCustomer content, inputs, outputs and personal data are not used to train general-purpose or cross-customer models, under Aive’s policy.Privacy policy
DataEU/EEA processing prioritised for core services; safeguarded transfers possible under the policy and the contract.Privacy policy, contract
AccessNeed-to-know access for authorised personnel.Trust Center, contract

Last verified on 26 September 2026. In case of discrepancy, the Trust Center (trust.aive.com), the privacy policy, the DPA and the contract prevail.

Framework and compliance

Who commits, and to what scope.

Aive policy

Legal entity and contact

The identity of the Aive entity and its privacy contact are set out in the official privacy policy and on the Trust Center.

Read the privacy policy
Trust Center

SOC 2 Type II

Aive publishes a SOC 2 Type II report. Its scope and the period covered are presented on the Trust Center.

See the SOC 2 scope
Under way

ISO 27001

The ISO 27001 process is under way. It will only be presented as achieved once the corresponding evidence is published.

Contract

DPA and processing roles

The DPA sets out controller and processor roles, documented instructions and applicable safeguards.

Your content

Your content stays yours.

Aive policy

Ownership of content and outputs

You retain ownership of your content. The treatment of outputs is set out in Aive’s policy and the contract.

Aive policy

No cross-customer training

Under Aive’s policy, customer content, inputs, outputs and personal data are not used to train general-purpose or cross-customer models. A dedicated model is only possible under written agreement.

Policy and contract

Sub-processors, location and transfers

EU/EEA processing prioritised for core services. Sub-processors, transfers and safeguards follow the privacy policy and the contract.

Retention, deletion, revocation and export

Retention periods, deletion, access revocation and export are defined by Aive’s policy and the contract, depending on your workspace.

Data use

Your data, product by product.

We never use our business customers’ data to train our models.

Enterprise

Aive Studio

The Aive Studio Enterprise offer strictly governs how that data is used and can provide physically separate infrastructure at the customer’s request.

Workspace

Aive GEO

In Aive GEO, analysing the questions asked to the Expert and how the platform is used helps improve topic and trend detection, as well as service quality. Enterprise customers’ data, however, is kept for their own needs, within their workspace.

Anonymised or aggregated

Creator media

For creator media, data from interactions and usage may be used to run the media and the Aive network and to improve their experience. When it is used across the network for analysis, discovering new topics and trends, recommendations or improving the services and the product, it is used in anonymised or aggregated form.

Security review

Your security review, in four steps.

  1. 01
    Visit the Trust CenterCompliance statuses, SOC 2 Type II scope and published resources, with their date.
  2. 02
    Send your requestSecurity questionnaire, DPA, sub-processors or report: describe your need in the form below.
  3. 03
    Agree the contractual frameworkDPA, processing roles, location, retention, service levels and, where relevant, a dedicated model under written agreement.
  4. 04
    Start within a controlled scopeA first scope on a dedicated workspace, with corpus, roles and access defined at scoping.

What we can share

Within the scope published on the Trust Center and, where needed, under NDA:

  • SOC 2 Type II resources
  • DPA and sub-processor information
  • Answers to your security questionnaire
Security / Procurement

A security or procurement request? Write to us.

Is your team assessing Aive? Describe your need and the Security team will reply with the relevant resources.

  • Security questionnaires and vendor reviews
  • DPA, processing roles and sub-processors
  • SOC 2 Type II resources within the published scope
  • API, SSO and integration questions

Security / procurement request

* required fields
About you
Documents are shared within the scope published on the Trust Center and, where needed, under NDA.

Request sent to the Security team.

You will receive a reply with the resources matching your request.

What this page does not claim

  • Aive does not claim ISO 27001 certification: the process is under way.
  • The SOC 2 Type II report covers the scope described on the Trust Center, not every use.
  • No exclusive data location is promised: safeguarded transfers remain possible under the policy and the contract.
  • Authorised personnel may access content on a need-to-know basis.
  • This summary replaces neither the DPA, nor the contract, nor the official privacy policy.
Frequently asked questions
Are my videos used to train Aive’s models?

Under Aive’s policy, customer content, inputs, outputs and personal data are not used to train or improve general-purpose or cross-customer models. A model dedicated to one customer is only possible under written agreement.

Where is my data processed?

EU/EEA processing is prioritised for core services. Safeguarded transfers remain possible under the privacy policy and the contract, which set out sub-processors and applicable safeguards.

How do we handle our DPA or security questionnaire?

Send your request through the Security / Procurement form. The Security team handles the DPA, processing roles and questionnaire within the contractual framework.

What service levels does Aive offer?

Service levels are defined in the contract, depending on plan and scope. This site does not publish numeric SLAs; the incident process and status page are described by Aive.

Is SSO available?

SSO, roles and audit are offered depending on the availability and configuration of your plan. Your requirement is confirmed at scoping.

Let’s prepare your security review, together.