# Security

> Calven stores customer data in the European Union on Microsoft Azure, runs its AI models inside its own Azure tenant in the EU data zone, and does not train models on your data. Every customer is a separate tenant, and data is encrypted in transit and at rest. Calven's first SOC 2 audit (Type 1) is in progress. Documents and the authoritative subprocessor list are in the Trust Center at https://trust.calven.ai.

- Source: https://calven.ai/security
- Last updated: 2026-09-30

---

## Where is customer data hosted?

- Customer data is stored in the European Union on Microsoft Azure, Sweden Central. There is no self-hosted infrastructure and no secondary cloud provider.
- The application runs on Azure Container Apps with HTTPS-only ingress. The database is Azure Database for PostgreSQL with public network access disabled, reachable only over a private endpoint.
- Secrets are held in Azure Key Vault with role-based access and a private endpoint.
- Database backups run daily with 35-day retention, point-in-time restore, and a geo-redundant copy in a second Azure region.

## Which subprocessors and AI model providers does Calven use?

Only Microsoft Azure and, for scheduled voice interviews, ElevenLabs process workspace content. Every other subprocessor receives account, billing, or usage data only, never documents, transcripts, personas, or messaging.

| Subprocessor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Cloud hosting, data storage, AI model inference, and monitoring | European Union |
| ElevenLabs | Conversational voice AI for AI-conducted win/loss interviews (optional) | United States |
| Bright Data | Web search and public web page retrieval for the research agents | Israel |
| Clerk | User sign-in and identity management | United States |
| Stripe | Payment processing, invoicing, and subscription billing | United States |
| Resend | Transactional email: invitations, notifications, and interview scheduling | United States |
| PostHog | Product analytics and error monitoring for the web app | United States |
| Attio | Customer relationship management for Calven's own customer records | European Union |
| Linear | Internal tracking of support requests and product feedback | European Union |
| Slack | Internal operational notifications | United States |

AI models: research, persona, positioning, messaging, and document analysis, plus in-product chat, the Slack app, and the MCP server, run on GPT-class models through Azure AI Foundry (Azure OpenAI Service) inside Calven's Azure tenant, in the EU data zone. Customer data is not sent to OpenAI, Anthropic, or any consumer AI service. The one exception is AI-conducted win/loss interviews, which run on ElevenLabs. On that path the conversational model is provided by OpenAI, with Anthropic and Google as failover, as ElevenLabs' subprocessors.

The table is a copy for readability. The authoritative list is published at https://trust.calven.ai, and workspace admins are notified by email at least 14 days before a subprocessor is added.

## Does Calven train AI models on customer data?

No. Calven does not train models on customer data and never uses one customer's data to produce outputs for another. This is a commitment in the Terms of Use (https://calven.ai/terms) and the Data Processing Addendum (https://calven.ai/dpa). Under Microsoft's Azure AI terms, prompts and outputs are not used to train models and are not shared with other Azure customers.

## How long is data retained?

- Model provider: Azure OpenAI may keep prompts and outputs for up to 30 days to detect abuse. Only authorised Microsoft personnel located in the EU can review them.
- Voice interviews: no audio is recorded or retained. ElevenLabs keeps the transcript for 30 days, and Calven holds the only long-lived copy.
- Workspace: data is kept for as long as the workspace is in use. When a subscription ends, the workspace is kept read-only for 90 days, then deleted, with a 30-day restore window. On written request, Calven deletes or returns the data within 30 days. Backups age out within 35 days of deletion.
- Export: on request, Calven delivers a full export of the workspace within 10 business days as Markdown, CSV, and the original uploaded files.

## How is data encrypted and access controlled?

- Encryption: TLS 1.2 minimum on every external and internal path. AES-256 at rest across the database, file storage, and Key Vault. Integration credentials are additionally encrypted at the application layer.
- Tenant isolation: row-level security in the database scopes every customer-facing query to one tenant and fails closed: a request without a tenant context matches no rows. Every AI surface reads only the workspace the user belongs to.
- Customer side: workspace administrators manage members and their roles (admin, contributor, user). SAML and OIDC single sign-on are included on Enterprise.
- Calven side: production access is held by two named company officers. MFA is required. There is no standing administrative access to the production database; access runs through a ticketed, time-boxed window that is logged and reviewed.
- Integrations: every connector is optional and authorised by the workspace administrator. CRM and call-recording connectors are read-only, and Calven never writes to the customer's CRM.

## Is Calven SOC 2 compliant?

- SOC 2 Type 1: the audit is in progress with Thoropass Assurance, an AICPA-registered CPA firm, covering the Trust Services Criteria for Security and Confidentiality. Auditor fieldwork began on September 28, 2026, and the final Type 1 report is expected at the end of October 2026. The report goes to customers and prospects under NDA as soon as it is issued.
- SOC 2 Type 2: the observation period runs from October 1, 2026 to March 31, 2027, with the same scope. A third-party penetration test of the platform, including cross-tenant isolation, is scheduled inside that window.
- GDPR: for customer data, the customer is the controller and Calven is the processor. The Data Processing Addendum is incorporated into the Terms of Use, so no separate signature is needed. Transfers to US subprocessors rely on the EU-US Data Privacy Framework or standard contractual clauses. See also the Privacy Policy at https://calven.ai/privacy.

## Where are the security documents?

Security controls, the subprocessor list, and the data residency statement are in the Trust Center at https://trust.calven.ai. The SOC 2 Type 1 report, the Information Security Policy, and the full business continuity plan are provided under NDA on request. Security questions go to security@calven.ai, answered within one business day. Security questionnaires and vendor onboarding forms go to procurement@calven.ai.

See also: [Pricing](https://calven.ai/pricing.md) · [About](https://calven.ai/about.md) · [Home](https://calven.ai/index.md)