Can you put your company's data on Ofivio?

OFIVIO (SMC-PRIVATE) LIMITED, a single-member private company registered in Pakistan, with its office in Lahore. The same entity is named on every policy.

Google Cloud Platform, us-central1 (Iowa, United States). VO's language-model and speech providers process requests in the United States and Europe. If you are outside those places, the transfer relies on the providers' standard contractual clauses.

TLS in transit, AES-256 at rest, including uploaded files. Standard hardening headers on every response.

Every workspace has its own identifier, and every read and write is scoped to the identifier in your signed session token. The scoping is enforced on the server and again by database rules — not by hiding things in the interface. A request for another organisation's record fails at the source.

Yes — 2FA is mandatory on every account and cannot be switched off. Every sign-in — password or Google — is completed with a one-time code, so a password alone never opens an account. Every sign-in — password or Google — is completed with a one-time code, so a password alone never opens an account. Anyone can also enrol an authenticator app (Google Authenticator or any TOTP app) from their own settings and take their codes off the phone instead of the inbox; the shared secret is sealed with AES-256-GCM under a key that never leaves the server. Email is never removed, so a lost phone is a nuisance rather than a lock-out. Enterprise SSO — SAML 2.0, OAuth 2.0, OpenID Connect — is available on agreement. A hardware key or passkey is not yet offered.

Yes, and it is separate from roles. The Workspace owner can lock any dashboard: a person who holds the role still holds it and still cannot open the room until the owner generates a code and hands it over. It is the control for payroll, the ledger and partner-level figures — grant somebody the role they need to work, and keep the room that holds the money shut until you decide otherwise.

No, and it is contractual. VO sends only what is needed to answer a request — your question and the records your own role may read — and our agreements forbid the providers from using it for model training. VO cannot exceed your permissions: what a role cannot see, VO cannot retrieve, summarise or act on. Voice audio is not retained.

Every subprocessor is listed with what it does and what it receives: Google Cloud for hosting, Anthropic, OpenAI and DeepSeek for VO's language models, ElevenLabs for speech, Google reCAPTCHA for abuse control, and Google Analytics on the public pages only — never on workspace data.

You do. The principal downloads the whole workspace as one ZIP — every record and every file, drawings and photographs included — from Settings at any time, on any plan; the archive is signed, the link lives an hour, and the download is audited. The same ZIP restores into this workspace or a new one. We do not sell your data or advertise against it.

A cancelled or unpaid workspace is suspended, not deleted: the data is kept for 90 days, exportable throughout, and restored exactly as it was if you come back inside that window. After 90 days it is permanently deleted, and it ages out of backups as they cycle.

Almost everything deleted inside a workspace goes to a recycle bin for 30 days — projects, tasks, clients, files, records, and everything inside them — and the principal brings it back with one press. A deleted workspace itself can be undone for 30 days. Not covered: a few records removed inside a database transaction.

Nightly database backups kept 30 days, point-in-time recovery over 7 days, and delete protection on the database. A restore from a real nightly backup was performed and verified on 9 September 2026, and is re-tested quarterly.

Actions inside a workspace are written to an immutable trail — who acted, on what, when, and what changed. It cannot be edited or deleted from the application, including by an administrator.

Roles are enforced on the server, not hidden in the interface. An assignment is private to the people on it; internal margins, vendor rates and payroll are invisible to the roles that should not hold them, and the client portal is read-only and shows only what you share.

Yes — a standard Data Processing Agreement is published and forms part of the Terms for every customer, with nothing to sign before you can rely on it: the controller/processor split, processing on documented instructions, confidentiality, the security measures, subprocessors and how they change, help with data-subject requests, breach notification, deletion and return, and international transfers. A counter-signed copy on your own paper is available for an Enterprise agreement.

Write to contact@ofivio.com with the subject line "Security", or read the machine-readable contact at /.well-known/security.txt. We aim to acknowledge within two business days and to keep you updated until it is resolved. We will not pursue a researcher who reports in good faith.