Every enterprise software vendor claims to take security seriously. The claim that actually matters is narrower: which specific controls is the architecture built around, and can you verify them before you connect a real inbox, a real CRM, or real financial data — not after.
Architected around SOC 2 control objectives
STIV is built around SOC 2's five trust service criteria from the ground up rather than retrofitted later: security, availability, processing integrity, confidentiality, and privacy. In practice that shows up as access scoped per division and per role, encryption in transit and at rest by default, and every consequential action landing in a timestamped, reversible audit trail — the same audit trail described in our approval gates piece.
Data residency for regulated teams
Teams in regulated industries — finance, legal, healthcare-adjacent — often have a hard requirement about where data physically lives, not just how it's encrypted. STIV offers data residency options so that requirement is a configuration decision at onboarding, not a blocker discovered during procurement review.
What this doesn't mean
"Architected around SOC 2 control objectives" is not the same claim as "SOC 2 Type II certified," and we're careful not to blur the two. Certification is a point-in-time attestation from a third-party auditor; architecture is the design decisions that make passing that audit possible in the first place. If your procurement process requires a completed certification or a specific report, ask directly — the honest answer is more useful than a vague one.
- Encryption in transit and at rest, by default, with no opt-out tier.
- Per-division, per-role access scoping — covered in more depth in how STIV connects without a migration.
- Full audit trail: every agent decision logged, timestamped, and reversible.
- Data residency options available for regulated teams at onboarding.
The underlying principle is the same one behind the approval gate model: verify before you trust. Ask what's actually been built and audited, not just what's been claimed on a website — including this one.