Trust Center

Software is developed under a documented Software Development Life Cycle Policy. Changes are peer-reviewed before merge, dependencies are monitored for known vulnerabilities, and findings are triaged under our Vulnerability Management Policy.

We may provide security-related reports upon request.

Diversio completes customer security questionnaires and vendor due-diligence assessments on request. Request access through this Trust Center and our security team will respond with a completed questionnaire.

Customer data is encrypted in transit using TLS and at rest using AES-256. Data is classified under a formal Data Classification Policy, with retention and disposal governed by our Data Retention Policy. Access to production data is role-based, logged, and reviewed.

We take the usage of AI seriously in our organization and work to ensure security and reliability of the AI.

We prioritize and take environmental, social, and governance (ESG) considerations seriously in our operations and decision-making processes.

Diversio processes personal data in accordance with applicable privacy law and its Data Classification and Data Retention Policies. Subprocessors are listed on this page and governed by our Vendor Management Policy.

Access is granted on a least-privilege basis through a documented request and approval workflow. Multi-factor authentication is enforced on email, cloud infrastructure, and code repositories. Access is reviewed periodically and revoked promptly on termination.

Diversio runs on Amazon Web Services in Canada (ca-central-1) and the European Union (eu-north-1), deployed across multiple Availability Zones. Infrastructure is defined as code and change-controlled.

Company devices run full-disk encryption, anti-malware, automatic updates, and enforced screen lock, monitored continuously through our compliance platform and device management tooling.

Production networks are segmented, protected by security groups with least-privilege rules, and monitored. Public endpoints are served over TLS.

Personnel acknowledge an Acceptable Use Policy and Code of Conduct. Email is protected against phishing and malware, and access to corporate systems requires multi-factor authentication.

We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.

We maintain a documented Incident Response Plan with designated response personnel, defined severity levels, and a defined notification process. The plan is reviewed at least annually.

Diversio maintains a documented Risk Assessment Policy. Risks are identified, assessed for likelihood and impact, assigned owners, and tracked to treatment. Supply chain risk is managed through our Vendor Management Policy.

Hardware and software assets are inventoried and tracked through their lifecycle under an Asset Management Policy, including secure disposal governed by our Data Retention Policy.

Backups run daily with 30-day retention and are encrypted at rest. Our recovery objectives are a Recovery Time Objective under 4 hours and a Recovery Point Objective under 24 hours. Services are deployed Multi-AZ on AWS. The Business Continuity Plan and Disaster Recovery Plan are reviewed at least annually.

All personnel complete security awareness training at onboarding and annually, acknowledge the Acceptable Use Policy and Code of Conduct, and take part in periodic phishing simulation exercises.

Changes are peer-reviewed via pull request, tested, and approved before deployment under a formal Change Management Policy. Production infrastructure changes are managed as code.

Production systems run in AWS data centres, which provide physical and environmental controls under their own audited programs. Diversio maintains a Physical Security Policy covering its own premises and remote working.

Control operation is monitored continuously through an automated compliance platform, with alerting on failures and defined remediation ownership.