Trust center
How Secuvon is run, stated as facts you can check.
Who operates the service, which providers handle data, how to report a vulnerability and what is not in place yet. Where something does not exist, this page says so.
At a glance
- Operator
- NexPhase Technology Limited, registered in Ireland
- Company number
- 767639
- Registered office
- Dun Laoghaire, County Dublin, Ireland
- Where the service runs
- United States (Railway region sfo)
- Certifications
- None yet
- Security contact
- [email protected]
Certifications and audits: none yet
Secuvon does not hold SOC 2, ISO 27001, ISO 42001 or any other certification or attestation, and no independent penetration test of the service has been completed. The controls the service does have are described on the security page.
Providers and data destinations
The services Secuvon uses, one mail integration awaiting delivery proof, and the model provider you connect with your own key. Reviewed .
Reconciliation pending: this list is being reconciled with our internal vendor register. If you sign a DPA with us, the providers named in its schedule take precedence over this page.
| Provider | What it does for us | Data involved | Location | Status |
|---|---|---|---|---|
| Railway | Runs the Secuvon application, its PostgreSQL database and its Redis cache. | Everything the service stores: accounts, encrypted provider keys, targets, scan results and evidence, and audit records. | United States (Railway region sfo) | In use |
| Cloudflare | DNS and the network edge in front of secuvon.ai. | Visitor IP addresses, request metadata and the traffic passing to and from secuvon.ai. | Global edge network | In use |
| Resend | Configured to send product email, such as account activation and password reset. | When a product message is sent, the recipient's email address and message content. | United States | Configured; delivery unverified |
| Zoho Mail | Hosts our support, security and privacy mailboxes. | Messages you send to those addresses and our replies. | European Union (Zoho EU data centre) | In use |
| The AI model provider you choose | Receives the test prompts of each assessment you run, sent with the provider key you store. Supported: OpenAI, Anthropic, Google Gemini, xAI and DeepSeek. | Test prompts and the target's responses, under your own account with that provider. | Set by that provider and your account with it | Chosen by you |
Not in use today: Stripe (payments for paid plans) and Sentry (error monitoring) are supported in the code but not connected to the hosted service, so no data reaches them.
Data protection
- Data processing agreement: what a DPA with us covers and how to request a signed one.
- Privacy policy: how Secuvon processes personal data.
- GDPR readiness: which product controls can support GDPR work.
Report a vulnerability
Email [email protected]. The contact and policy are published in our security.txt. We aim to acknowledge reports within 3 business days.
Service status
The status page shows live checks of the API, database and cache. Secuvon does not publish an uptime history yet.