How we protect what you put in

Security evidence is itself sensitive: it describes where a plant is weak. So the product is built on the assumption that someone will try, and limits what any one mistake or break-in can reach.

What you might worry about	What the product does
Another customer seeing your data	The database itself refuses it, whatever the application asks. Every change to the product is tested for it before it can be released.
Our own staff reading your evidence	AvahTech operators see customers as names and counts only. Support access, if you allow it, is view-only, time-limited and recorded.
Records quietly changed	Every action goes into an audit log in which each entry is chained to the one before, so an edit or deletion shows.
One person approving their own work	Uploaded evidence waits in quarantine for a second person; whoever records findings cannot sign them.
Phishing and stolen passwords	Staff can sign in with their company’s own Microsoft or Google account and its multi-factor check. Everyone else uses a password with a second check. A company’s sign-in reaches only that company’s workspaces.
Attacks through the browser	Only the page’s own scripts may run, no other site may frame our pages, and connections are HTTPS only.
The collector being misused	It connects outwards only, reads from sources your administrator approved by name, and has no way to receive a command.
Where your data lives	Each workspace is assigned a data region and the service is built to keep its data there, so a German plant’s evidence can stay in Europe and an Indian plant’s in India. The regions open to you are stated in your agreement.

We will not tell you a system is hack-proof; nobody honestly can. Before the first customer goes live, the service is tested by an independent firm, and we will share the summary under a confidentiality agreement.