Hivenza

Security

Your brands and customers, kept safe

Hivenza holds the keys to your social accounts and the conversations with your customers. Here is how we protect them, what control you have, and what we are still working on.

How your data is protected

Encrypted, in transit and at rest

  • Every connection to the website, the app and the API uses HTTPS (TLS).
  • Tokens for your social networks, payment numbers and other secrets are encrypted with AES-256-GCM before they are stored, and never shown again.
  • Passwords are stored only as a one-way hash (bcrypt), never in a form that can be read back.
  • Files and recordings are kept in cloud storage, encrypted by the provider.

Only the right people

  • Roles for owners, admins, editors and viewers, and your own roles built from fine-grained permissions, checked on every request.
  • Single sign-on with Microsoft Entra ID, Okta, Google Workspace or any SAML or OpenID Connect provider, with SCIM provisioning (Enterprise plan).
  • Two-step sign-in with an authenticator app or passkeys, which owners can require for the whole workspace.
  • Access limited to your office networks, if you want, and every signed-in device listed, with a way to sign it out.
  • Sessions that end after the time you set or when left idle, and one step to sign everyone out of the workspace.
  • Emergency access for an owner when your single sign-on is down: with a reason, for a few hours, and recorded.
  • API keys, connected apps and AI assistants reach only the workspaces you allow.

A trail of who did what

  • An activity log of important actions: connections, publishing, roles, exports, deletions and sign-ins.
  • Export it as a spreadsheet at any time, or stream it as it happens to your own security tools (Splunk, Datadog or any HTTPS endpoint).
  • Session replays of your website visitors are watched only by people allowed to see customer details, and every watch is logged.
  • The log can't be quietly changed: each entry is chained to the one before, and the chain is checked every night.
  • Who opened which conversation, and from where, is recorded too.

Your data stays yours

  • Choose how long tickets and contacts are kept; after that they are anonymised or deleted by themselves.
  • Export your tickets, contacts and activity log, delete a contact on request, or delete the whole workspace and everything in it.
  • We never sell your data, and never use your posts, messages or contacts for advertising.
  • A data processing agreement is ready for your company to accept in the app.
  • Card numbers, bank account numbers and one-time codes are taken out of messages and notes as they are written.
  • What your workspace marks sensitive is encrypted with its own key, which can be replaced so nothing older can be read with it.
  • Keep data per channel for as long as you choose, hold it for a legal matter, and erase a person with a certificate to prove it.

Built to resist misuse

  • Limits on how fast anyone can try passwords, codes, sign-ups and public forms, with a human check where bots try their luck.
  • A strict content security policy on our pages, and secure, HTTP-only session cookies.
  • Webhooks we send are signed, so your systems can tell they came from us.
  • Every permission and refusal is covered by automated tests, run against a real database.

Watched, and ready to respond

  • Errors are logged for our team, without passwords or network tokens in them.
  • If a breach ever affects your data, we tell you without undue delay, with what happened and what we are doing, as the law and our data processing agreement require.
  • Only a small team at Hivenza can reach production systems, and each action in our operations console is recorded with the person and the reason.

For regulated teams

  • AI switched off for a workspace or a channel, kept away from topics such as financial advice, or made to wait for a person's approval.
  • Customers proven before their account is discussed: a signed identity from your website or app, or a one-time code by WhatsApp.
  • Complaints numbered and followed to their deadline, with a register to export, and conversations sampled for quality review.
  • Approved wording locked and versioned, disclaimers added by themselves, and any conversation as a PDF with a fingerprint that shows it hasn't changed.

Open about how we work

  • A public status page with each incident, its updates, and updates by email.
  • A vulnerability disclosure policy that says what can be tested and how quickly we answer.
  • Every change checked for known vulnerabilities in the components we use, with a list of each one.
  • Our penetration test report shared on request under confidentiality terms, once the first test is done; for banks and insurers under DORA, the register details and exit plan they need.

Compliance

Hivenza is operated by Versity Life Co-Ltd and follows the EU General Data Protection Regulation and Cameroon's law on personal data protection.

We act as your processor for the data of your customers and contacts, under our data processing agreement.

Hivenza is not certified to SOC 2 or ISO 27001 yet. We run our work to their controls, and will share the reports on request once an independent auditor has issued them, as we do with our penetration test report (below).

Email through your own mail system

By default, Hivenza sends your answers through its own email provider. A brand can send every email through its own mail system instead, so each one sits in its Sent folder and follows its archiving and data-loss rules. Each way below says what Hivenza holds and the path an email takes. Any way is used only after a test email through it has arrived and an admin has chosen it. If it fails, emails wait: they never go through Hivenza instead unless an owner chooses that, and that choice is logged.

A relay you run
A signing secret, sealed with your workspace's own key.
Hivenza posts the composed email, signed, to your HTTPS address. Your relay hands it to your mail server. We provide a reference relay.
Your own Amazon SES
No keys. Only a role in your AWS account that it may take on with an external id only you and it know.
Hivenza takes on the role for 15 minutes, visible in your CloudTrail, and sends from your SES account, under your limits and your suppression list.
Microsoft 365 or Google Workspace
A permission to send as one mailbox, sealed with your workspace's own key. Never a password.
The email goes through Microsoft Graph or the Gmail API as that mailbox. Your admin sees the permission and can withdraw it in their own console.
An SMTP server
An app password or a relay account's password, sealed with your workspace's own key. Never your people's own passwords.
Only over TLS, to the public address checked before connecting, with the server's certificate checked against its name.

Bounces and complaints from your system reach Hivenza's suppression list, from forwarded bounce reports or from your SES events, so a dead address isn't written to again. None of these secrets is ever shown again, written to a log, or readable through the API or by Hivenza's team.

Found a security problem?

Write to hello@hivenza.com with "Security" in the subject, and tell us what you found and how to see it. Please give us a reasonable time to fix it before telling anyone else, and don't access other people's data or disrupt the service while testing. We read every report and thank those who help.

hello@hivenza.comRead the disclosure policy

Our penetration test report

We haven't had an independent penetration test yet. Ask now and we send you its summary once we have it.

Which report

Questions

Where is our data stored?

Where your data is stored and processed is set out in our privacy policy, and every provider that processes data for us is listed, with its country, on the page of who processes data for us. For a written statement for a compliance review or a contract, write to us.

Can Hivenza's staff read our conversations?

Only when you ask us for help with something specific, or when the law requires it. Our operations console shows plans, usage and payments, not the content of your posts or conversations, and every action in it is recorded.

What happens to our data if we leave?

Export what you need, then delete the workspace. Everything in it is deleted; only the payment records accounting law requires are kept, and an anonymous record that a deletion happened.

Do you sign data processing agreements?

Yes. An owner accepts it in Hivenza under Settings → Data and privacy, on behalf of your company, and downloads the signed copy. For changes to it, write to hello@hivenza.com.

We're a bank under DORA. What can you give us?

The details for your register of information (Enterprise customers download them under Settings → Data and privacy), how you can leave with your data, the chain of providers behind Hivenza, and our incident commitments. For the full pack, write to hello@hivenza.com.

Questions from your security team? We're happy to answer them.

Write to hello@hivenza.com.