ISO 27001
The ISO 27001 process is under way. It will only be presented as achieved once the corresponding evidence is published.
Published SOC 2 Type II report, GDPR framework, ISO 27001 in progress. Your content is not used to train general-purpose or cross-customer models. Isolated workspaces, roles and permissions, dedicated SSO on Enterprise; our team answers security questionnaires and DPO reviews.
Secure by design: customer data is never used to train models, and intellectual property remains fully with the customer. SOC 2 Type II · GDPR · encryption in transit and at rest · access controls · logs. ISO 27001 in progress.
Aive publishes a SOC 2 Type II report and operates within a GDPR framework; the ISO 27001 process is under way. Under Aive’s policy, customer content, inputs, outputs and personal data are not used to train general-purpose or cross-customer models. Encryption, access controls and logs are described on the Trust Center; the DPA and the contract set out processing, location, retention and service levels.
This is the wording Aive publishes. It never goes beyond its source.
| Topic | Published wording | Where to verify |
|---|---|---|
| SOC 2 | Aive publishes a SOC 2 Type II report; see the Trust Center for its scope. | Trust Center |
| ISO 27001 | ISO 27001 process under way. | Trust Center |
| GDPR | GDPR framework; the DPA and the contract define the processing. | Privacy policy, DPA |
| No training | Customer content, inputs, outputs and personal data are not used to train general-purpose or cross-customer models, under Aive’s policy. | Privacy policy |
| Data | EU/EEA processing prioritised for core services; safeguarded transfers possible under the policy and the contract. | Privacy policy, contract |
| Access | Need-to-know access for authorised personnel. | Trust Center, contract |
Last verified on 26 September 2026. In case of discrepancy, the Trust Center (trust.aive.com), the privacy policy, the DPA and the contract prevail.
The identity of the Aive entity and its privacy contact are set out in the official privacy policy and on the Trust Center.
Aive publishes a SOC 2 Type II report. Its scope and the period covered are presented on the Trust Center.
The ISO 27001 process is under way. It will only be presented as achieved once the corresponding evidence is published.
The DPA sets out controller and processor roles, documented instructions and applicable safeguards.
You retain ownership of your content. The treatment of outputs is set out in Aive’s policy and the contract.
Under Aive’s policy, customer content, inputs, outputs and personal data are not used to train general-purpose or cross-customer models. A dedicated model is only possible under written agreement.
EU/EEA processing prioritised for core services. Sub-processors, transfers and safeguards follow the privacy policy and the contract.
Retention periods, deletion, access revocation and export are defined by Aive’s policy and the contract, depending on your workspace.
We never use our business customers’ data to train our models.
The Aive Studio Enterprise offer strictly governs how that data is used and can provide physically separate infrastructure at the customer’s request.
In Aive GEO, analysing the questions asked to the Expert and how the platform is used helps improve topic and trend detection, as well as service quality. Enterprise customers’ data, however, is kept for their own needs, within their workspace.
For creator media, data from interactions and usage may be used to run the media and the Aive network and to improve their experience. When it is used across the network for analysis, discovering new topics and trends, recommendations or improving the services and the product, it is used in anonymised or aggregated form.
TLS 1.2+ encryption in transit, encryption at rest, restricted access, logs, backups and continuity, as described by Aive.
Workspace isolation, roles, SSO and audit depending on the availability and configuration of your plan.
Enterprise API on quote, with scopes, limits and support defined in the contract. Scopes, keys and webhooks are documented in the published OpenAPI specification.
The incident process, status page and support are described by Aive; service levels are defined in the contract.
Within the scope published on the Trust Center and, where needed, under NDA:
Is your team assessing Aive? Describe your need and the Security team will reply with the relevant resources.
You will receive a reply with the resources matching your request.
Under Aive’s policy, customer content, inputs, outputs and personal data are not used to train or improve general-purpose or cross-customer models. A model dedicated to one customer is only possible under written agreement.
EU/EEA processing is prioritised for core services. Safeguarded transfers remain possible under the privacy policy and the contract, which set out sub-processors and applicable safeguards.
Send your request through the Security / Procurement form. The Security team handles the DPA, processing roles and questionnaire within the contractual framework.
Service levels are defined in the contract, depending on plan and scope. This site does not publish numeric SLAs; the incident process and status page are described by Aive.
SSO, roles and audit are offered depending on the availability and configuration of your plan. Your requirement is confirmed at scoping.