Security & Privacy

1. Our Commitment

We use reasonable administrative, technical, and organizational measures intended to reduce the risk of unauthorized access, loss, misuse, alteration, or disclosure of information under our control. We review safeguards in light of the nature of the work, the sensitivity of the information, and reasonably foreseeable risks.

2. Security Governance

Security responsibilities are incorporated into how we scope projects, manage access, select service providers, deliver client work, and respond to issues. Depending on the engagement, our practices may include:

• Defining authorized systems, accounts, and project responsibilities
• Limiting access according to business need and project scope
• Reviewing access when roles change or work concludes
• Maintaining procedures for reporting and escalating suspected incidents
• Reviewing relevant risks when introducing new tools, integrations, or workflows

3. Identity and Access Controls

We encourage access practices designed to prevent unnecessary exposure. Where supported and appropriate, these practices may include role-based permissions, individual user accounts, multifactor authentication, temporary access, strong authentication controls, and prompt revocation of access that is no longer required.

Clients should provide the least-privileged access appropriate for the requested work and avoid sending passwords or other secrets through ordinary email, chat, or project notes when a safer access method is available.

4. Data Protection

We seek to handle client and personal information only for legitimate business purposes and authorized services. Protection measures may include secure transport provided by modern platforms, permission controls, backups or recovery features, and provider-supported encryption, depending on the system and configuration.

We do not ask clients to provide sensitive information that is not needed for the engagement. Clients should notify us before providing regulated, highly confidential, or sensitive personal data so that appropriate scope and safeguards can be evaluated in advance.

5. Cloud Platforms and Service Providers

Anrivo uses established hosting, ecommerce, analytics, communications, payment, advertising, CRM, automation, and AI providers to operate our business and deliver services. We consider the nature of the service and data involved when selecting and configuring providers.

Third-party platforms maintain their own security programs, terms, privacy practices, availability commitments, and controls. Their safeguards may apply in addition to Anrivo’s practices. We do not represent that every provider offers the same controls or certifications.

6. Secure Service Delivery

For website, ecommerce, advertising, SEO, automation, and integration projects, we aim to build security into delivery through appropriate configuration, controlled access, change review, and testing relevant to the scope of work.

Security updates, hosting maintenance, plugin or dependency management, backups, monitoring, and ongoing support are provided only when included in the applicable proposal, statement of work, subscription, or maintenance agreement. We clearly recommend that clients keep production systems and dependencies supported and up to date.

7. Monitoring and Incident Response

We maintain processes intended to identify, evaluate, contain, and address suspected security events affecting systems or information under our control. When a confirmed incident affects client information, we will work to investigate and communicate as appropriate under the circumstances and applicable obligations.

We may work with clients, hosting providers, software vendors, professional advisers, or authorities when reasonably necessary to investigate or respond to an event.

8. Data Retention and Disposal

We retain information only as long as reasonably needed to provide services, maintain business and project records, support clients, resolve disputes, meet legal or accounting obligations, and protect our rights. When information is no longer required, we may delete, anonymize, or allow it to expire according to applicable processes and platform capabilities.

Backup copies and third-party platform records may remain for a limited period according to provider retention cycles or legal requirements.

9. AI and Automation Security

AI and automation systems can involve additional data flows, integrations, and third-party processing. We evaluate intended use, permissions, data sensitivity, and workflow behavior when designing client solutions.

• We do not use client-provided confidential business data to train public AI models unless expressly agreed in writing.
• We recommend limiting sensitive data submitted to AI tools and applying human review to consequential outputs.
• Third-party AI providers may process information under their own terms, privacy policies, retention settings, and security controls.
• Clients remain responsible for lawful notices, consents, data quality, and appropriate use of automated outputs in their business.

10. Security Is a Shared Responsibility

Effective security depends on both Anrivo and our clients. Clients are responsible for the security of systems and decisions they control, including account ownership, user permissions, endpoint security, employee access, legal compliance, data submitted to platforms, and implementation of recommendations outside our contracted scope.

We recommend that clients use multifactor authentication, unique credentials, least-privileged access, supported software, reliable backups, staff awareness, and a documented process for promptly reporting suspicious activity.

11. Privacy and Your Rights

Our Privacy Policy explains the categories of information we collect, why we use it, when it may be shared, how long it may be retained, and the choices available to you. Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or other action regarding personal information.

To submit a privacy request, email info@anrivo.com. We may need to verify your identity and authority before completing certain requests.

12. Report a Security Concern

If you believe you have discovered a security issue involving Anrivo, our website, or a system we manage for you, please report it promptly. Include a clear description, the affected page or system, steps to reproduce the issue, and your contact information. Please do not include passwords, private keys, sensitive personal data, or unnecessary client information in the initial report.

Please act in good faith, avoid accessing or modifying data that does not belong to you, do not disrupt services, and allow us a reasonable opportunity to investigate before publicly disclosing a suspected issue. This page does not create a bug bounty program or authorize testing that would otherwise be unlawful.