ALVAO Trust Center

The EU AI Act applies to ALVAO as both a provider and deployer of AI systems. 

ALVAO is committed to responsible use of artificial intelligence in line with the EU Artificial Intelligence Act (EU AI Act). ALVAO aligns its product AI features with relevant requirements of the EU AI Act and implements appropriate governance, transparency, and oversight measures. 

ALVAO is committed to using AI in an ethical, legal and responsible way. Governed and controlled use of AI features is supported by our internal policies and risk management.

Our approach includes controls:

• Human oversight – AI supports users and does not replace decision-making  
• Transparency – users are informed when interacting with AI features, and documentation explains the purpose, capabilities, and limitations of AI functionality. Refer to: ALVAO AI features
• Data security & protection – Customer data is protected with security measures and not used to train AI models. Refer to: Privacy Policy 
• Monitoring – relevant events are logged and monitored, related risks are addressed within the incident response process.

By default, AI features in ALVAO are powered by Microsoft Azure AI Services, including Azure OpenAI Service. AI features in ALVAO are designed primarily as assistive and automation tools and do not perform fully autonomous decision-making. AI outputs are intended to support users, and final decisions remain under customer control.

AI features in ALVAO support areas such as:

• Service desk automation (e.g. ticket summarization, categorization, incident support)
• Knowledge management (e.g. content suggestions and assistance)
• Self-service and chatbot capabilities
• Data insights and recommendations (e.g. similarity detection, sentiment analysis)

Customers can disable AI functionalities at any time via Online Application settings; this setting is preserved across updates and upgrades. Disabling AI features may affect the performance or availability of certain product functions.

ALVAO is GDPR compliant. We process personal data only based on customer instructions and support customers in fulfilling their GDPR obligations, including data subject requests and breach notifications.

ALVAO holds ISO/IEC 27001:2022 certification covering the development, sale, implementation, provision and support of ALVAO Service Desk and ALVAO Asset Management, including cloud services.

ALVAO maintains an Information Security Management System (ISMS) aligned with ISO/IEC 27001.

Code of practice for information security controls for cloud services, building on ISO/IEC 27001.

Code of practice for protection of personally identifiable information (PII) in public cloud environments acting as PII processors.

ALVAO is audited againts SOC 2 Type II requirements by BDO. The annual report covering and validating security, availability, confidentiality, integrity & privacy of our infrastructure, controls and customers data. 

The report is available on request under the NDA.

Cyber Essentials certification demonstrating alignment with fundamental cyber security controls.

ALVAO aligns it's cloud controls to the 14 NCSC Cloud Security Principles (data in transit, asset protection & resilience, separation between customers, governance, operational security, personnel security, secure development, supply chain, secure user management, identity & authentication, external interface protection, secure service administration, audit information & alerting, and secure use of the service). Full mapping is provided after request.

All of the ALVAO infrastructure is built on a modern cloud-native architecture leveraging Microsoft cloud services to ensure best possible availability, security and scalability. Key services include Azure, Azure SQL Database, Azure Storage, Microsoft Entra ID and Azure Monitor / Application Insights. 

See more information about Azure's security and compliance here.

• Multi-Factor Authentication (MFA) is enforced for ALVAO employees, when accessing essential systems
• Role-Based Access Control (RBAC) with least privilage principle is implemented.
• Conditional Access for admins

ALVAO uses industry best practices to encrypt customer data:

• Data at Rest: encrypted using Microsoft managed keys - Advanced Encryption Standard (AES) 256-bit
• Data in Transit: secured via HTTPS (TLS 1.2 and 1.3).

Customer-managed encryption keys (BYOK) are available for eligible customers, either generated in a certified Hardware Security Module under customer-controlled access, or imported from customer-managed key stores, where technically available and explicitly agreed.

• Azure Web Application Firewall (WAF)
• DDoS Protection, 
• Network Segmentation - Separation of development, testing and production environments. Customer resources are in separated network infrastracture, and customer's data are not used in development or testing evironments.  

ALVAO has processes in place to detect, respond to, and manage security incidents. Customers are informed of relevant incidents in accordance with contractual obligations and applicable regulations.

• general Security incident = within 72 hours (DPA Art. 11.3); 
• for public administration of the Czech Republic Cyber security event = within 24 hours (KeGC Art. 6.2).

Vulnerability and patch management processes are in place to identify, assess, and remediate security vulnerabilities through regular scanning and timely application of security updates.

Security event logging is implemented to record and monitor system activities, with logs securely stored, regularly reviewed, and supporting alerting for timely detection and response to security events.

Regular third-party penetration tests are performed at least on yearly basis and are aligned with OWASP security standards. Findings are mitigated according to their severity.

Your data remains yours. ALVAO acts as a data processor, while customers remain data controllers. The Privacy Policy explains:

• What personal data we process and why
• Legal basis under GDPR
• Your rights as a data subject and how to exercise them

Our Terms of Service include provisions on how personal data is processed as a Controller in connection with the use of our software (see clause 15 — Privacy Policy Principles). Processing as a Processor on the Customer's behalf is governed separately by the Data Processing Agreement (DPA).

Information about the cookies we use and how to manage your preferences.

ALVAO engages selected third-party service providers ("subprocessors") to support the delivery of its services. These subprocessors may process customer data solely under ALVAO’s instructions and in accordance with applicable data protection laws.

Customers may subscribe to notifications about changes.

Service levels, responsibilities and commitments are defined in our Terms of Service.

Depending on the Customer's registered location, the Terms of Service are entered into with one of the following ALVAO entities:

• United States: ALVAO Inc.,
• United Kingdom: ALVAO Ltd.,
• European Union (and all other countries not listed): ALVAO s.r.o..

ALVAO provides a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR. The DPA defines the roles and responsibilities of ALVAO as a data processor and our customers as data controllers.
The DPA is available upon request for customers.

ALVAO provides a dedicated DORA Addendum for customers that qualify as Financial Entities under Regulation (EU) 2022/2554, where explicitly agreed in the Offer. The addendum covers ICT incident notification, audit rights, subcontractor transparency, security certifications (ISO/IEC 27001, 27017, 27018, SOC 2 Type II), and exit strategy support. It applies only to ICT services that do not themselves support a Critical or Important Function of the customer; an extended regime applies otherwise by separate agreement.

Data classification is defined in alignment with contractual and regulatory requirements. The following table classifies the types of data processed by ALVAO ITSM and their respective handling policies.

ALVAO's contractually guaranteed Service Level is 99.9% monthly uptime, as defined in our SLA. %. If the guaranteed Service Level is not met in a given month, customers may be entitled to Service Credits (10% or 25% of the monthly Online Application fee, depending on severity) as defined in the SLA

Continuous 24/7 monitoring and alerting keeps our services under constant oversight. Planned maintenance is communicated to customers in advance.

Customer Data at rest will be stored exclusively in Microsoft data centers according to the contracting entity:

• if the Provider is ALVAO s.r.o., in the territory of the European Union or the European Economic Area;
• if the Provider is ALVAO Ltd., in the territory of the United Kingdom;
• if the Provider is ALVAO Inc., in the territory of the United States of America.

The Customer may select a different location for Customer Data if technically available and expressly agreed in the Agreement.

Databases use zone- or geo-redundant backup storage, with geo-redundant copies kept in a paired Azure region. ALVAO performs daily backups of VMs and application services, plus continuous point-in-time database backups with defined retention periods. Backups are checked weekly, and full restore testing is done at least annually.  

Upon termination of the service, customer data is deleted or anonymized in accordance with contractual obligations and retention policies, and backups are purged according to defined backup retention cycles.

Under the EU Data Act, EU/EEA customers can export their data at any time, provided as a standard SQL database backup. Extraction may take more than 30 days depending on data volume. ALVAO does not charge fees for switching cooperation, unless stated otherwise in contractual terms. Switching assistance is currently provided individually; self-service automated switching tools are not yet available.

Our development follows best practices aligned with OWASP. We perform internal OWASP tests and product vulnerability scanning, including automated source code analysis prior to production deployment.

The EU Data Act (Regulation (EU) 2023/2854) applies to ALVAO as a data processing service provider, and to our customers based in the EU/EEA. It sets out rules on fair data access, portability, and switching between service providers.

Customers retain full ownership of their data and can export or delete it at any time, in accordance with contractual terms and the EU Data Act. ALVAO does not charge fees for switching cooperation, unless stated otherwise in contractual terms.

ALVAO Service Desk and Asset Management are listed in official public sector cloud computing catalogues across multiple jurisdictions:

• United Kingdom — Listed on the UK G-Cloud framework (G-Cloud 14, Service ID 121706671705959) as "ALVAO IT Service Management," the British public sector equivalent of eGovernment Cloud.
• Czech Republic — Listed in the Czech eGovernment Cloud Computing Catalogue (Provider ID 023, registered 14 February 2023), enabling public sector bodies to procure our services centrally. Dedicated terms apply, including EU-only data residency (West/North Europe), 24-hour cybersecurity event reporting, and enhanced SLA termination rights (see KeGC Addendum).
• Slovakia — Listed in the Slovak Government Cloud Catalogue (Katalóg služieb Vládneho cloudu SR), Provider ID 18, with both ALVAO Asset Management and ALVAO Service Desk registered as SaaS offerings.

The EU Digital Services Act (Regulation (EU) 2022/2065) is an EU regulation. It applies to ALVAO as a hosting service provider serving EU customers. 

ALVAO does not moderate, review, or assess the legality of Customer Data — the Customer remains the sole provider of any intermediary service using the Online Application and bears all related DSA obligations toward its end users. If ALVAO receives a report or notice concerning allegedly illegal content within Customer Data, we cannot disregard it: we will act on it in accordance with the DSA, and will redirect the reporting party to the Customer where legally possible.

ALVAO has achieved PinkVERIFY® Certified status on 7 processes for ALVAO, Certified Until June 8, 2027.

An accredited Pink Elephant IT management consultant has assessed and confirmed the compatibility of ALVAO in the following ITSM processes:

• IT Asset Management 
• Change Management
• Configuration Management 
• Incident Management 
• Problem Management 
• Request Management 
• Service Catalog Management  

ALVAO maintains an internal reporting system in accordance with the Czech Whistleblower Protection Act, allowing employees, volunteers, and other qualifying persons to report concerns safely, including anonymously. Reports can be submitted in writing, by phone, or in person to our designated Competent Person, or alternatively to the Czech Ministry of Justice.

ALVAO takes a zero-tolerance approach to modern slavery across our business and supply chains. Suppliers are reviewed annually for compliance with our ethical standards, and employees receive regular training on these obligations.