Security

What we store

Agorvia holds no patient data and no clinical trial data. We store:

• Your account: name, email address, your organization and your role in it.
• What you put in: vendor dashboards, saved shortlists and, where they're switched on, inquiries and peer notes.
• Questions asked of the help assistant, for 90 days. Copies of the emails we send, for 30 days.
• Page and search counts without any user ids, so vendors see totals, never who viewed them.

The privacy policy has the full list and how long each is kept.

Where it's kept

We build on providers that each publish independent SOC 2 reports:

• Vercel: hosting, uploaded files and the assistant's AI gateway
• Neon: the database
• Clerk: sign-in and accounts
• Resend: email
• Anthropic, through Vercel: answers from the help assistant

How it's protected

• Encrypted in transit (HTTPS only, with HSTS) and at rest by our providers.
• Sign-in by one-time codes sent to your email. We never store passwords.
• Access by invitation. Every request is checked on our servers, so people only see their own organization's private data.
• Our team's actions, such as reviewing dashboards or changing listings, are recorded in an audit log.
• Uploaded files are checked by their content, and forms are protected against bots and floods.
• The database keeps a point-in-time history we can restore from.

Security questionnaires

We don't have our own SOC 2 report yet. If your company needs a security questionnaire answered, write to us at the address below.

Report a security problem

If you think you've found a vulnerability, email security@agorvia.bio with what you found and how to reproduce it. We'll reply within three working days.

Please don't access or change other people's data, and give us a reasonable time to fix the problem before telling anyone else.