Data Processing

When your organisation connects data to Avir, it is the controller of that data and Lansar Industries, Inc., 1511 3rd Ave, Suite 1002-1044, Seattle, WA 98101, United States processes it on its behalf. These terms form part of the Terms of Service. A signed copy, with Standard Contractual Clauses, is available on request from hello@avirhq.com.

What we do with it

We process Customer Data only to provide Avir as your organisation instructs through the product and these terms: importing and syncing it, storing it, building your business model and the features on top, and sending the parts an AI feature needs to the AI provider in use. Nothing else, unless the law requires it, in which case we tell you first where we may.

How we protect it

• Each workspace's data is kept apart from every other's, in storage and in queries.
• Credentials for your sources are encrypted (AES-256-GCM). Data travels over TLS.
• Access is by role within your organisation; our staff access Customer Data only to support you or keep the service running.
• Outbound connections are limited to public addresses, so a connection can't reach our internal systems.
• Backups are encrypted and kept for a limited time.

Subprocessors

We use the subprocessors listed here, under written terms at least as protective as these. We'll give 30 days' notice of a new one; you may object, and if we can't address it, end the affected service.

Incidents

We'll tell you without undue delay, and within 72 hours, after becoming aware of a breach affecting Customer Data, with what we know and what we're doing about it.

Help and audits

We'll help you answer people exercising their rights, and with assessments and consultations, as far as Avir's processing is involved. We'll answer reasonable security questionnaires.

When it ends

You can export your data while your account is active. After the agreement ends we delete Customer Data within 30 days, and from backups as they expire.