Trust centre
POCAVI connects to production Salesforce orgs, so the questions below are the ones worth asking before you grant that. Where the answer is "not yet", it says so.
Infrastructure
POCAVI runs entirely on AWS serverless infrastructure, defined in code through CDK. There are no long-lived servers to patch and no shared application hosts between customers.
All production infrastructure runs in eu-west-2 (London) today. Stockholm (EU), Virginia (US) and Singapore (APAC) are built and ready to deploy, and are coming as customers need them. If you have a data residency requirement, tell us and we will bring your region up.
DynamoDB and S3 are encrypted at rest with AWS-managed keys. Salesforce credentials and API secrets use a dedicated KMS key. All traffic is TLS, and the API sits behind AWS WAF.
Every record is partitioned by customer at the database key, so a query cannot cross a customer boundary. Access is checked at the API authoriser before a request reaches a handler.
Passwords are stored with scrypt at OWASP-aligned parameters and a per-user salt, with a twelve character minimum enforced on the server. Optional two-factor authentication is required at sign-in once you turn it on. Repeated failures lock an account and an address for fifteen minutes. You can end every session on every device from your own settings, and a password reset does the same; revoked sessions stop working within five minutes.
Team members are Admin, Deployer or Viewer. A Viewer cannot run a data load, a masking job, a metadata rollback or a deployment, and only an Admin can erase a data subject. That is enforced in the API, not just hidden in the interface.
Cancel and your data is deleted within thirty days: every database record, every file, and the OAuth tokens for your connected orgs. A daily job enforces the deadline rather than waiting for someone to remember, and it writes a record of what was removed that survives the deletion, so we can confirm it in writing.
Destructive operations take a snapshot first and restores are audited. Data loads can be reverted. Subject erasure produces a verifiable deletion proof, and every change to a connected org records who made it.
Your Salesforce data
The most useful thing to know about POCAVI's data handling is what it refuses to hold.
POCAVI backs up Salesforce metadata: objects, fields, flows, Apex, layouts, permissions. Backups never contain your customer records, which is a deliberate design decision and keeps the largest store we hold free of personal data. Some features do read records, because they cannot work otherwise: Forecast reads opportunities and stores the figures behind a snapshot, and Compliance searches for a named person across your objects on request. Those reads happen under your own OAuth grant, are scoped to the feature you invoked, and are never used to train a model.
Orgs connect through Salesforce OAuth. We never ask for or store a Salesforce password. You can revoke POCAVI's access from Salesforce setup at any time, without involving us.
Sandbox seeding anonymises personal data before it is written, and sandbox compliance checks flag environments carrying unmasked production data.
AI
POCAVI uses AI for natural language queries, formula generation, release note drafting and change analysis.
AI inference runs through Anthropic's API. Prompts are not retained for model training under our agreement with them.
Only metadata patterns are sent: object and field names, types and relationships. Your Salesforce records are not sent to a model to answer a query.
If your organisation does not permit third-party model use, the AI features can stay switched off and the rest of the platform works without them.
Honest gaps
POCAVI is a young product. Publishing the gaps is more useful to you than an empty certifications page, and it means the claims above can be taken at face value.
We hold no security certification today. We intend to pursue SOC 2, and we are not committing to a date we cannot yet stand behind.
No independent penetration test has been carried out. If your procurement process requires one before purchase, tell us and we will discuss arranging it.
We monitor availability internally with CloudWatch alarms, but there is no public status page and no contractual uptime commitment yet.
Documents and review
If your security questionnaire needs an answer this page does not cover, send it over and we will complete it.
Request a security review