Skip to main content

​
Security Program Overview

​
Executive Summary

Avoca maintains a defense-in-depth security program designed to protect customer data across its cloud infrastructure, applications, personnel, and operating processes. Avoca is SOC 2 certified and maintains controls for access management, change management, monitoring, vendor oversight, and incident response. The exact scope and period covered by an assurance report can change. Customers conducting due diligence should request the current report and supporting materials from their Avoca account or security contact.

​
Security Leadership and Accountability

Security responsibilities are shared across executive and engineering leadership, with clear ownership for technical controls, compliance activities, risk decisions, and customer communication. Avoca also uses qualified external security and legal specialists when independent expertise is appropriate. Key practices include:
  • Executive visibility into material security risks and control gaps
  • Named owners for security controls and remediation work
  • Periodic policy, access, vendor, and risk reviews
  • Independent assurance and testing where required by the security program

​
Third-Party Risk Management

Avoca relies on cloud and software providers under a shared-responsibility model. Providers that handle sensitive data or support critical operations are evaluated according to their role and risk. Reviews can include:
  • Security and privacy documentation
  • Independent assurance reports or certifications
  • Data handling, retention, and deletion terms
  • Access controls and incident-notification commitments
  • Business continuity and service availability

​
Personnel and Access

Employees and contractors with system access are subject to security requirements appropriate to their role. Access is provisioned according to business need, protected with strong authentication, and removed when no longer required. See Identity and Access Controls for more detail.

​
Customer Assurance

Avoca’s security program includes:
  • SOC 2 certification
  • Encryption for data in transit and at rest where supported by the service architecture
  • Role-based access and multi-factor authentication for privileged systems
  • Security monitoring and incident-response procedures
  • Vulnerability and dependency management
  • Vendor and personnel security controls
For questionnaires, assurance reports, contractual security terms, or architecture-specific questions, contact your Avoca account team.