Security at Possitiv.

All traffic between your browser and Possitiv is encrypted using TLS 1.2+. Customer data is encrypted at rest using AES-256 on managed cloud infrastructure.

Email/password and supported SSO providers, with role-based access controls. Administrative actions are scoped to the principle of least privilege.

Possitiv runs on hardened, enterprise-grade cloud providers with logical tenant isolation, segmented networks, and managed Postgres with row-level security.

Application, infrastructure, and authentication events are continuously logged and monitored. Anomalies trigger alerts to our on-call engineers.

Code is peer-reviewed, dependencies are scanned, and infrastructure changes go through a controlled deployment pipeline with audit trails.

We maintain an incident response process covering detection, containment, eradication, recovery, and post-incident review. Customers affected by a material incident are notified without undue delay.

Possitiv secures the platform; you control who has access to your workspace, what data is uploaded, and how integrations are configured. Strong workspace hygiene matters.

Customer data is never sold and is not used to train third-party AI models. Subprocessors are vetted and bound by contractual security and confidentiality obligations.