Security

We build automation and AI systems that sit close to core business processes — invoices, customer records, approvals, support conversations. That places real responsibility on us, and we treat security as part of delivery rather than something added at the end.

Our practices are organised around PIPEDA's safeguards principle: protection proportionate to the sensitivity of the information, covering organisational, technical and physical measures.

• Access to client systems and data is granted on a least-privilege basis and limited to the people working on that engagement.
• Access is reviewed when someone joins, changes role or leaves a project, and revoked promptly when it is no longer needed.
• Everyone working on an engagement is bound by written confidentiality obligations.
• Sub-processors and vendors are reviewed before use and are required by contract to provide a comparable level of protection.

• Data in transit is encrypted using current TLS versions; this website is served over HTTPS throughout.
• Credentials and API keys are held in managed secret stores, never in source control.
• Multi-factor authentication is required on the accounts used to administer client systems.
• Changes are peer-reviewed before release, and dependencies are monitored for known vulnerabilities.
• Environments used for development and testing are separated from production.

Where an engagement runs in a client's own cloud tenancy, that environment's controls apply and are agreed in writing before work begins.

If we become aware of a breach of security safeguards affecting personal information under our control, we assess whether it creates a real risk of significant harm — weighing the sensitivity of the information and the probability of misuse, as PIPEDA requires.

• Where that threshold is met, we report to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible.
• We also notify any other organisation that may be able to reduce the risk of harm.
• Where we act as a service provider, we notify the client without undue delay so they can meet their own obligations.
• We keep a record of every breach of security safeguards for 24 months, including those that do not meet the reporting threshold, and produce those records to the Commissioner on request.

Security of a delivered system depends on both sides. We are responsible for how we build, configure and operate what we deliver. Clients remain responsible for managing their own user accounts and permissions, for the accuracy and lawfulness of the data they put into a system, and for the security of the environments they control.

If you believe you have found a security weakness in one of our systems or on this website, email hello@ravisolutions.ai with enough detail to reproduce it. Please give us a reasonable opportunity to investigate and remediate before disclosing it publicly. We will not pursue action against researchers who report in good faith and avoid privacy violations, service disruption or data destruction.

TODO_COPY — list any certifications or audit reports actually held (for example SOC 2, ISO 27001, cyber insurance), or state plainly that none are held yet. Do not publish a claim that cannot be evidenced.

Questions about security can go to our privacy and trust contact at hello@ravisolutions.ai, or by phone at +1 289-992-4445. We aim to acknowledge every enquiry within five business days.

TODO_COPY — add the registered postal address. CASL requires a valid mailing address in commercial messages, and PIPEDA expects a named, reachable accountable person.