Built to be trusted with your customers' data.
Culvion combines tenant isolation, encryption, access controls and configurable communications safeguards. Customers remain responsible for assessing their use case, configuration and legal obligations.
Security controls and assurance status
Tenant isolation at the database
Postgres row-level security is designed to enforce tenant-scoped queries at the data layer in addition to application checks. Customers should review the current architecture, tests and operational controls for their use case.
Encryption and deletion controls
Designated sensitive fields use application-level encryption with a configured, versioned key. Verified erasure clears covered live fields; backups and external provider copies require separate reconciliation and follow-up. See our Privacy Policy.
Configurable communications safeguards
Workflows can apply suppression lists, consent records, calling windows, recording notices, unsubscribe handling and privacy-request tooling. These features support a compliance program; they do not make every campaign compliant automatically.
Voice trust controls
Where enabled and supported by the selected telephony provider, deployments can use caller authentication, reputation monitoring and configurable calling rules. Availability varies by provider and destination.
Privileged-access controls
The intended operating model avoids routine standing access and uses time-boxed, approval-gated, logged access for support or incident response. Request the current access-control evidence before deployment.
Current assurance status
Culvion does not currently claim an independent security certification and does not currently offer a Business Associate Agreement (BAA). Request the current subprocessor list, data-processing terms and available security documentation before deployment.
Need the full security package?
Request the current subprocessor list, data-processing terms, architecture overview and available security documentation for your review.
