Security at Viato

Our Commitment

Mortgage professionals trust Viato with their pipelines, their client relationships, and their communications. Protecting that data is a core part of how we build and operate the platform. This page summarizes the security measures we have in place.

Independent Security Assessment

CASA is an industry security standard developed by the App Defense Alliance. Validation is performed against the OWASP Application Security Verification Standard and is renewed on an annual cycle.

Data Encryption

• All data is encrypted in transit using TLS
• All data is encrypted at rest using AES-256
• Encryption keys are managed through hardened cloud key management services and are never stored in application code

Access Control & Tenant Isolation

• Role based access controls limit every user to the data their role requires
• Customer data is logically isolated per organization, with row level security enforced at the database layer
• Multi factor authentication protects administrative access to production systems
• Internal access to customer data is restricted to a small number of authorized employees on a least privilege basis, and that access is logged

Infrastructure

Customer data is stored exclusively in secure cloud data centers located in the United States and operated by providers certified to SOC 2 and ISO 27001. Physical security at those facilities is managed by the providers under their certification programs. Data is protected by encrypted automated backups.

Network Security & Monitoring

• All production traffic passes through an enterprise web application firewall with DDoS protection at the network edge
• Application and infrastructure events are monitored continuously with real time alerting
• Alerts are triaged by severity, with critical issues addressed immediately

Secure Development

• Application code and dependencies are scanned with static analysis and dependency vulnerability scanning as part of our release process
• Findings are remediated based on severity before release
• Production, development, and testing environments are fully separated

Incident Response

We maintain a documented incident response process covering identification, containment, remediation, and notification. Affected customers are notified promptly if an incident involves their data.

Insurance

Viato carries cyber liability insurance covering data breach response in addition to professional and general liability coverage.

Your Data Belongs to You

Your data is your property. We never sell it, share it with other users without your permission, or use it outside the core functionality of the platform. You can request deletion of your data at any time. Full details are in our Privacy Policy.

Questions or Reports

Detailed security documentation is available to customers and partners on request under NDA. To report a suspected vulnerability or request documentation, contact us at privacy@viato.ai.