Trust center

Operational intelligence
built on trust.

HavenOPS is the Operational Intelligence Platform for compliance-driven organizations. This hub summarizes how HavenOPS secures, governs, activates, and operates the platform our customers rely on. It is a governance summary, not an independent certification.

Overview

What this Trust Center covers.

A single, public summary of how HavenOPS operates across security, privacy, data governance, responsible AI, client activation, organization verification, environment separation, commercial governance, implementation closure, and service commitments.

Security & Access Privacy Data Governance Compliance Readiness Responsible AI Client Activation Organization Verification Implementation vs Production Commercial Governance Implementation Closure Service Commitments System Status

Security & access

A foundation designed for regulated operations.

Security is how the platform is built, deployed, and operated every day — including role-based access, tenant-scoped data, modern authentication, and append-only audit logging.

Encryption in transit & at rest

TLS for all traffic; encrypted database and object storage at the platform layer.

Tenant isolation

Every record is scoped by organization and enforced by row-level security on each query.

Secure SDLC

Reviewed, reversible platform changes and least-privilege production access.

Role-based access — super admin, owner, admin, HR admin, supervisor, and staff, each with explicit, auditable permissions.

Row-level enforcement on every sensitive record; cross-tenant access is prevented by policy, not configuration.

Admin-controlled provisioning, role changes, and revocation governed by customer organization administrators.

Modern authentication with weak-password protection enforced at signup and reset.

SSO-ready for enterprise identity providers.

Admin-issued password recovery workflows with audit trails on every reset.

Append-only audit trails on sensitive records and administrative actions.

Who, what, when, and from where — captured for reads, writes, and administrative changes.

Exportable audit evidence available to customer administrators for internal review.

Read the full Security & Trust page

Privacy

Customer data, scoped and governed.

Detailed disclosures live in the HavenOPS Privacy Policy. This section summarizes the practices most customers ask about during a security review.

Data minimization

Only the operational data needed to run training, documentation, HR operations, and readiness workflows is collected.

Storage

Hosted on managed cloud infrastructure in the United States with isolated tenant scoping and encrypted backups.

Retention & deletion

Per-tenant retention is configurable; hard deletion is supported on request as part of tenant lifecycle.

Sub-processors

A current sub-processor list is available under NDA via the Security Trust Packet.

Read the full Privacy Policy

Data governance

Clear ownership. Clear boundaries.

HavenOPS treats Customer Data as the customer's data. Governance controls define who can access it, how it is scoped, and how changes are recorded.

Ownership

Customer Data — including uploaded documents, workforce records, training progress, and operational content — remains the customer's data. HavenOPS processes it to deliver the platform.

Tenant scoping

Every record is scoped to the owning organization. Cross-tenant access is not a configuration toggle — it is prevented at the data layer.

Change of record

Sensitive administrative and record-level changes are captured in append-only audit trails, attributable to the actor, and available to customer administrators.

Export & portability

Customer administrators can export operational records for their own audit and portability needs, subject to their role permissions.

Compliance readiness

Continuous, evidence-backed readiness.

The HavenOPS Compliance Readiness Center helps customers organize training, documentation, workflows, accountability tasks, and evidence — assembled as work happens. Compliance readiness is a governance capability, not an independent certification.

HIPAA-aligned controls

Administrative, physical, and technical safeguards are documented; BAAs are available for customers who require them. This is a governance posture, not an independent certification.

SOC 2 readiness

HavenOPS is designed against SOC 2 control expectations for security, availability, and confidentiality. Independent attestation, when available, will be published in the Security Trust Packet.

Compliance Readiness Center

Training, documentation, workflows, accountability tasks, and evidence assembled continuously as work happens.

References to frameworks such as HIPAA or SOC 2 describe the controls and readiness posture HavenOPS designs and operates against. They are not a claim of independent certification unless a specific attestation is published in the Security Trust Packet.

Responsible AI

AI assists. Humans approve.

Every AI-assisted recommendation in HavenOPS is generated to support a human decision-maker — never to replace one.

AI assists — it does not decide. Clinical, compliance, HR, and operational actions require a human reviewer.

AI outputs are assistive and require human review before operational, clinical, compliance, or workforce use.

AI-assisted recommendations are logged, attributable, and reversible.

PHI and sensitive identifiers are not embedded in realtime notifications or broadcasts.

HavenOPS does not use Customer PHI or Customer-Confidential Data to train foundation models.

Model providers and prompt patterns are documented; customers can request the current AI disclosure.

Client activation

A governed path from Discovery to Production.

Live operational access begins only after required service documents, billing setup, and activation review are completed. Each phase produces a governance artifact so both parties know what was agreed.

Phase 01
Discovery
Understand the operational environment, roles, regulatory context, and readiness goals.
Phase 02
Solution Design
Configure modules, roles, and workflows to match how the organization actually runs.
Phase 03
Implementation
Build out the tenant, content, and integrations in a dedicated implementation environment against an agreed scope.
Phase 04
Service Activation
Complete required service documents, billing setup, and activation review before any live-operations access is granted.
Phase 05
Operational Readiness
Validate controls, training, documentation, and human-approval steps are in place.
Phase 06
Production Launch
Move the organization into live operations under structured approval, with governance artifacts recorded.
Phase 07
Platform Adoption
Ongoing enablement, optimization, and periodic operational review.

Organization verification

Who we activate, and why it matters.

HavenOPS applies an Organization Identity Verification Standard before granting production access to a new customer organization.

Prospective customer organizations are verified against the HavenOPS Organization Identity Verification Standard before production access is granted.

Verification confirms the requesting organization is a legitimate operating entity and that the individuals granted administrative access are authorized to act on its behalf.

Verification is a governance step — it does not replace the customer's own onboarding, credentialing, or workforce checks.

Verification outcomes are recorded as part of the activation record for that organization.

Environments

Implementation environments vs. production organizations.

HavenOPS separates the environment used to build and configure a tenant from the live environment used to run operations.

Implementation environments

Non-production tenants used during Discovery, Solution Design, and Implementation. They may contain sample data, in-progress configuration, and test users. Implementation environments are not audit-of-record and are not used to run live operations.

Production organizations

Live tenants activated after Service Activation and Operational Readiness review. Production organizations carry customer operational data, generate audit-of-record evidence, and are governed by the customer's own policies and role assignments.

Separation of roles

Implementation-environment access is scoped to configuration work. Production access is provisioned separately, under customer administrator control, once activation is complete.

Commercial governance

Scope, changes, and renewals — on the record.

HavenOPS follows a Commercial Governance Standard so scope, environments, activation status, and commercial changes are documented and traceable.

Commercial terms — including scope, service commitments, and pricing — are documented in the customer's order form or master services agreement, not published on this page.

Changes to scope, environments, or activation status follow the HavenOPS Commercial Governance Standard, so both parties have a clear record of what changed and when.

AI-assisted features, tenant limits, and any usage-based components are described in writing before activation, so there are no undisclosed operational obligations.

Renewal, expansion, and off-boarding follow the same governance process — no silent scope drift.

Pricing and specific commercial terms are provided directly to prospective customers as part of the Solution Design and order-form process. They are not published on this page.

Implementation closure

A clean handoff from build to operations.

Under the HavenOPS Implementation Closure & Archival Policy, every implementation reaches a defined closure point before an organization operates under production governance.

Every HavenOPS implementation follows a defined closure step under the Implementation Closure & Archival Policy.

Closure records the final configuration baseline, the artifacts produced during implementation, and the transition point at which the organization is operating under production governance.

Implementation environments are archived or retired after closure, so they cannot be confused with production tenants.

Customers receive a clear indication when their organization has moved from implementation into production governance.

Service commitments

How we support customers in production.

Specific service levels, response targets, and availability commitments are set out in each customer's order form or MSA. This section summarizes the operating posture.

Support

Business-hours support for customer administrators, with a documented path for urgent operational issues.

Change management

Platform changes that affect governance, security, or activation flow are communicated to customer administrators in advance where practical.

Incident handling

Security-relevant incidents are triaged and communicated to affected customer administrators through their designated contacts.

Availability

HavenOPS is operated as a production SaaS platform on managed cloud infrastructure. Specific availability commitments, if any, are set out in the customer's order form or MSA.

System status

Public status page — coming soon.

Status page placeholder

A public system status page is on the roadmap. It will summarize platform availability and any active incidents in customer-safe language.
In the meantime, customer administrators receive incident communication through their designated contacts.
This section will be updated when the public status page is live.

Shared responsibility

A clear line between platform and customer.

HavenOPS secures the platform. Customers own their users, content, and decisions. The split is documented, not assumed.

HavenOPS responsibilities

Platform security, tenant isolation, encryption, audit logging, AI governance, activation governance, and infrastructure availability.

Customer responsibilities

User provisioning, role assignment, internal policy content, evidence ownership, and reviewing and approving AI-assisted recommendations.

Contact

Questions, security reviews, or vendor questionnaires.

Reach the HavenOPS trust team directly. We respond to security reviews, DPA requests, and vendor questionnaires from prospects and customers.

security@havenops.io support@havenops.io Request the Security Trust Packet

Ready for a deeper review?

We share architecture documentation, controls mapping, and DPAs under NDA as part of the Solution Design process.

Start your Solution Design Security & Trust

Operational intelligence built on trust.