Security and Compliance
Advo360 runs on U.S.-based cloud infrastructure with required multi-factor authentication, AES-256 encryption, database-level isolation between organizations, and a logged record of every view of survivor data.
Your funders will ask about this. Your board will ask about this. Your IT evaluator will ask about this. Here are the answers.
Required MFA.
Every person who signs in proves their identity with a second factor. No setting turns it off.
Encrypted where it matters.
Names, dates of birth, contact details, addresses, and documents are encrypted with AES-256.
Isolated by design.
Each organization's records are separated from every other organization's at the database level.
Every view logged.
Viewing a survivor's record leaves an entry in an audit trail the application cannot change.
What this means in plain language
Your staff are not guessing who can see what. Your funders are not hearing vague reassurances about data security. Your organization is not relying on informal workarounds to protect records that could endanger someone if they were exposed. Every person proves who they are before they see anything. Every session locks after inactivity. The information that identifies a survivor is encrypted, and every look at it is recorded.
Identity and access
Multi-factor authentication.
TOTP multi-factor authentication or a passkey, required for everyone. Administrators use passkeys. There is no option to disable it.
Individual accounts.
Every person has their own account. Staff are invited by a secure link, and administrators never set or see anyone's password.
Role-based access.
Each person sees only what their role requires. Volunteers cannot reach survivor records.
Restricted records.
An administrator can limit a survivor's record to named staff. Every access, and every refused access, is logged.
Session security.
Automatic sign-out after inactivity, with a warning first. Timeout length is set for your organization. Unsaved work is preserved securely and restored after sign-in.
Account protection.
Accounts lock after repeated failed sign-in attempts. Passwords must be at least 12 characters with mixed case, a number, and a symbol.
Data and infrastructure
Encryption.
Identifying information and uploaded documents are encrypted at the field level with AES-256, using FIPS-approved algorithms. HTTPS/TLS in transit.
Isolation.
Each organization's records are separated at the database level.
Audit trail.
Administrative actions and record views are written to an append-only log that the application cannot change.
Infrastructure.
U.S.-based cloud infrastructure. Our hosting provider holds SOC 1, SOC 2, ISO 27001, and FedRAMP certifications.
Release controls.
Every release passes a full automated test suite, a dependency vulnerability check, and a scan for exposed credentials before it reaches the platform.
Documents.
Files are encrypted before they are stored, checked by file type, never previewed, and every download is logged.
Deletion.
Deletion is a reviewed request, not a single click. Records under a legal hold cannot be deleted.
Survivor safety
Safety code words.
Masked for everyone, shown only on request, logged every time, and never included in reports or exports.
Address confidentiality.
Address Confidentiality Program participants' real addresses never appear on external letters, reports, or exports.
Legal holds.
A record under a legal hold cannot be changed or deleted until the hold is released.
Your data and legal requests
Ownership.
Your organization owns its data.
Legal demands.
If we receive a subpoena, warrant, or other legal demand for your data, we notify you promptly and give you the opportunity to object before any disclosure, unless the law forbids notice. We provide only what is legally compelled.
Breach notification.
If a breach affects your data, we notify you promptly.
Export.
Advo360 provides a complete export of your organization's data on request.
FAQ
Where is our data stored?
Can we require everyone to use MFA?
How do you handle data deletion requests?
Is Advo360 HIPAA compliant?
Does Advo360 meet CJIS requirements?
Can you provide documentation for our IT review?
The people you serve trust you with their most sensitive information.
Your technology should justify that trust.