ALVAO Trust Center

The EU AI Act applies to ALVAO as both a provider and deployer of AI systems. 

ALVAO is committed to responsible use of artificial intelligence in line with the EU Artificial Intelligence Act (EU AI Act). ALVAO aligns its product AI features with relevant requirements of the EU AI Act and implements appropriate governance, transparency, and oversight measures. 

ALVAO is committed to using AI in an ethical, legal and responsible way. Governed and controlled use of AI features is supported by our internal policies and risk management.

Our approach includes controls:

• Human oversight – AI supports users and does not replace decision-making  
• Transparency – users are informed when interacting with AI features, and documentation explains the purpose, capabilities, and limitations of AI functionality. Refer to: ALVAO AI features
• Data security & protection – Customer data is protected with security measures and not used to train AI models. Refer to: Privacy Policy 
• Monitoring – relevant events are logged and monitored, related risks are addressed within the incident response process.

By default, AI features in ALVAO are powered by Microsoft Azure AI Services, including Azure OpenAI Service. AI features in ALVAO are designed primarily as assistive and automation tools and do not perform fully autonomous decision-making. AI outputs are intended to support users, and final decisions remain under customer control.

AI features in ALVAO support areas such as:

• Service desk automation (e.g. ticket summarization, categorization, incident support)
• Knowledge management (e.g. content suggestions and assistance)
• Self-service and chatbot capabilities
• Data insights and recommendations (e.g. similarity detection, sentiment analysis)

Customers can disable AI functionalities at any time via Online Application settings; this setting is preserved across updates and upgrades. Disabling AI features may affect the performance or availability of certain product functions.

ALVAO is GDPR compliant. We process personal data only based on customer instructions and support customers in fulfilling their GDPR obligations, including data subject requests and breach notifications.

ALVAO holds ISO/IEC 27001:2022 certification covering the development, sale, implementation, provision and support of ALVAO Service Desk and ALVAO Asset Management, including cloud services.

ALVAO maintains an Information Security Management System (ISMS) aligned with ISO/IEC 27001.

Code of practice for information security controls for cloud services, building on ISO/IEC 27001.

Code of practice for protection of personally identifiable information (PII) in public cloud environments acting as PII processors.

ALVAO is audited againts SOC 2 Type II requirements by BDO. The annual report covering and validating security, availability, confidentiality, integrity & privacy of our infrastructure, controls and customers data. 

The report is available on request under the NDA.

Cyber Essentials certification demonstrating alignment with fundamental cyber security controls.

ALVAO aligns it's cloud controls to the 14 NCSC Cloud Security Principles (data in transit, asset protection & resilience, separation between customers, governance, operational security, personnel security, secure development, supply chain, secure user management, identity & authentication, external interface protection, secure service administration, audit information & alerting, and secure use of the service). Full mapping is provided after request.

All of the ALVAO infrastructure is built on a modern cloud-native architecture leveraging Microsoft cloud services to ensure best possible availability, security and scalability. Key services include Azure, Azure SQL Database, Azure Storage, Microsoft Entra ID and Azure Monitor / Application Insights. 

See more information about Azure's security and compliance here and here, or visit their Trust Center.

Learn how customer data is stored and processed in ALVAO SaaS and on-premises deployments, including tenant data separation, temporary data handling, and the Microsoft Azure technologies used by ALVAO features.

Customer Data at rest will be stored exclusively in Microsoft data centers according to the contracting entity:

• if the Provider is ALVAO s.r.o., in the territory of the European Union or the European Economic Area;
• if the Provider is ALVAO Ltd., in the territory of the United Kingdom;
• if the Provider is ALVAO Inc., in the territory of the United States of America.

The Customer may select a different location for Customer Data if technically available and expressly agreed in the Agreement.

• The principle of least privilege and role-based access control (RBAC)
• Multi-Factor Authentication (MFA) is enforced for ALVAO employees, when accessing essential systems
• Conditional Access for admins

ALVAO uses industry best practices to encrypt customer data:

• Data at Rest: encrypted using Microsoft managed keys - Advanced Encryption Standard (AES) 256-bit
• Data in Transit: secured via HTTPS (TLS 1.2 and 1.3).

Customer-managed encryption keys (BYOK) are available for eligible customers, either generated in a certified Hardware Security Module under customer-controlled access, or imported from customer-managed key stores, where technically available and explicitly agreed.

• Web Application Firewall (WAF)
• DDoS Protection
• Network Segmentation
• Separation of Development, Test, and Production Environments
• Control Access to Critical Systems
• Monitoring and Logging Security Events
• Regular review, testing, and evaluation of the effectiveness of the technical and organizational measures implemented. 

ALVAO has processes in place to detect, respond to, and manage Security Incidents and Personal Data Breaches. Customers are informed of relevant incidents in accordance with contractual obligations and applicable regulations. 

Specifically, under the Data Processing Addendum (DPA  Art. 11.3), if the Provider (ALVAO) becomes aware of a breach of security leading to the accidental or unauthorized loss, destruction, alteration, unauthorized disclosure of, or access to Customer Data, Professional Services Data, or Personal Data processed by the Provider (each a “Security Incident”), the Provider will, without undue delay and in any event within seventy-two (72) hours after becoming aware of the Security Incident: 

1. notify the Customer of the Security Incident; 

2. investigate the Security Incident and provide the Customer with detailed information about the Security Incident; and 

3. take reasonable measures to mitigate the effects and minimize any damage resulting from the Security Incident. 

Vulnerability and patch management processes are in place to identify, assess, and remediate security vulnerabilities through regular scanning and timely application of security updates of the infrastructure and software used.

Security events are collected through logging and integrated with centralized security monitoring and alerting capabilities, including Microsoft Sentinel and Microsoft Defender. Alerts are reviewed and correlated to support the identification of malicious activities, privilege misuse, investigation, and incident response.

Regular third-party penetration tests are performed at least on yearly basis and are aligned with OWASP security standards. Findings are mitigated according to their severity.

Your data remains yours. ALVAO acts as a data processor, while customers remain data controllers. The Privacy Policy explains:

• What personal data we process and why
• Legal basis under GDPR
• Your rights as a data subject and how to exercise them

Our Terms of Service include provisions on how personal data is processed as a Controller in connection with the use of our software (see clause 15 — Privacy Policy Principles). Processing as a Processor on the Customer's behalf is governed separately by the Data Processing Agreement (DPA).

Information about the cookies we use and how to manage your preferences.

ALVAO engages selected third-party service providers ("subprocessors") to support the delivery of its services. These subprocessors may process customer data solely under ALVAO’s instructions and in accordance with applicable data protection laws.

Customers may subscribe to notifications about changes.

**including AI connectors (Anthropic models) 

Service levels, responsibilities and commitments are defined in our Terms of Service.

Depending on the Customer's registered location, the Terms of Service are entered into with one of the following ALVAO entities:

• United States: ALVAO Inc.,
• United Kingdom: ALVAO Ltd.,
• European Union (and all other countries not listed): ALVAO s.r.o..

ALVAO provides a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR. The DPA defines the roles and responsibilities of ALVAO as a data processor and our customers as data controllers.

ALVAO provides a dedicated DORA Addendum for customers that qualify as Financial Entities under Regulation (EU) 2022/2554, where explicitly agreed in the Offer. The addendum covers ICT incident notification, audit rights, subcontractor transparency, security certifications (ISO/IEC 27001, 27017, 27018, SOC 2 Type II), and exit strategy support. It applies only to ICT services that do not themselves support a Critical or Important Function of the customer; an extended regime applies otherwise by separate agreement.

Data classification is defined in alignment with contractual and regulatory requirements. The following table classifies the types of data processed by ALVAO ITSM and their respective handling policies.

Continuous 24/7 monitoring and alerting keeps our services under constant oversight. Planned maintenance is communicated to customers in advance.

ALVAO maintains a structured backup program designed to ensure the availability and integrity of customer data.

Database infrastructure is protected through zone-redundant and geo-redundant storage mechanisms, with data replicated to a paired Azure region to safeguard against regional failure.

Customer database backups are governed by retention mechanisms:

Additionally, ALVAO performs daily backups of application services.

Under the EU Data Act, EU/EEA customers can export their data at any time, provided as a standard SQL database backup. Extraction may take more than 30 days depending on data volume. 

After termination, a 90-day export window is provided to download the backup, where available; ALVAO does not transform, migrate, or import data on the Customer's behalf. 

Additional assistance is available only where required by law or separately agreed. No fees apply for switching cooperation, unless stated otherwise in contractual terms.

Upon termination, ALVAO deletes or returns Personal Data at the Customer's instruction, following the Duration and Termination terms of the Agreement. 

Data retained in backups or archives that cannot be immediately removed is kept only until the regular retention cycle expires, and is not actively used during that period except for recovery, security, legal compliance, or defense of legal claims. 

Professional Services Data is removed from active systems once its business purpose is fulfilled, or earlier upon the Customer's written request.  

ALVAO maintains a formal Business Continuity and Disaster Recovery (BCDR) plan covering data restoration and service recovery in the event of a major incident.

• Recovery Point Objective (RPO): Data can be restored to a point no older than 15 minutes prior to an incident, supported by continuous database backups and Azure Storage redundancy.
• Recovery Time Objective (RTO): In the event of a major incident, full service restoration is targeted within 4 hours.

DR testing scenarios are performed on a regular basis to validate recovery procedures across key infrastructure components. Backup integrity is verified weekly, and full restoration procedures are tested at least annually to validate recovery readiness. 

ALVAO follows secure development practices aligned with OWASP guidance. Security controls are integrated throughout the software development lifecycle and include security testing, code review activities, and automated vulnerability scanning prior to production deployment.

The EU Data Act (Regulation (EU) 2023/2854) applies to ALVAO as a data processing service provider, and to our customers based in the EU/EEA. It sets out rules on fair data access, portability, and switching between service providers.

Customers retain full ownership of their data and can export or delete it at any time, in accordance with contractual terms and the EU Data Act. ALVAO does not charge fees for switching cooperation, unless stated otherwise in contractual terms.

ALVAO Service Desk and Asset Management are listed in official public sector cloud computing catalogues across multiple jurisdictions:

• United Kingdom — Listed on the UK G-Cloud framework (G-Cloud 14, Service ID 121706671705959) as "ALVAO IT Service Management," the British public sector equivalent of eGovernment Cloud.
• Czech Republic — Listed in the Czech eGovernment Cloud Computing Catalogue (Provider ID 023, registered 14 February 2023), enabling public sector bodies to procure our services centrally - dedicated terms apply.
• Slovakia — Listed in the Slovak Government Cloud Catalogue (Katalóg služieb Vládneho cloudu SR), Provider ID 18, with both ALVAO Asset Management and ALVAO Service Desk registered as SaaS offerings.

The EU Digital Services Act (Regulation (EU) 2022/2065) is an EU regulation. It applies to ALVAO as a hosting service provider serving EU customers. 

ALVAO does not moderate, review, or assess the legality of Customer Data — the Customer remains the sole provider of any intermediary service using the Online Application and bears all related DSA obligations toward its end users. If ALVAO receives a report or notice concerning allegedly illegal content within Customer Data, we cannot disregard it: we will act on it in accordance with the DSA, and will redirect the reporting party to the Customer where legally possible.

ALVAO has achieved PinkVERIFY® Certified status on 7 processes for ALVAO, Certified Until June 8, 2027.

An accredited Pink Elephant IT management consultant has assessed and confirmed the compatibility of ALVAO in the following ITSM processes:

• IT Asset Management 
• Change Management
• Configuration Management 
• Incident Management 
• Problem Management 
• Request Management 
• Service Catalog Management  

ALVAO maintains an internal reporting system in accordance with the Czech Whistleblower Protection Act, allowing employees, volunteers, and other qualifying persons to report concerns safely, including anonymously. Reports can be submitted in writing, by phone, or in person to our designated Competent Person, or alternatively to the Czech Ministry of Justice.

ALVAO takes a zero-tolerance approach to modern slavery across our business and supply chains. Suppliers are reviewed annually for compliance with our ethical standards, and employees receive regular training on these obligations.

ALVAO qualifies as a manufacturer of a product with digital elements under the EU Cyber Resilience Act. Based on our current assessment, ALVAO ITSM, Service Desk or Asset Management products are not classified as an Important or Critical product and ALVAO is expected to follow the standard manufacturer conformity assessment procedure. We are implementing processes and documentation necessary to meet the applicable CRA requirements. When applicable, the EU Declaration of Conformity for covered products will be made available through this Trust Center.

ALVAO products are designed and developed to conform with WCAG 2.2 Level AA, with accessibility built into our process from design through release. We regularly test against these standards and continue improving areas such as keyboard-only navigation.