Security
These are the questions a buyer or an IT team asks first. The full and current statement is on our Security page, and it describes only what is in place now.
- Where does Talven CX Studio run, and where is my data stored?
- Can my data stay in Europe or Switzerland?
- Is my data encrypted?
- Does Talven hold SOC 2 or ISO 27001?
- Does CX Studio Manager support single sign-on or two-factor sign-in?
- Can Talven staff see my workspace?
- Are there backups?
- Which AI models and providers does the Talven Web Assistant use?
- How do I report a security issue?
Where does Talven CX Studio run, and where is my data stored?
Talven CX Studio runs on Google Cloud in the us-central1 region (Iowa, United States), and its database is Google Cloud Firestore in the same region. Workspaces that Talven set up before November 2026 keep their database in MongoDB Atlas, on Google Cloud in the central United States, until they move.
Its files and backups are stored in the same Google Cloud region. The service that reads your website to build your Web Assistant runs on Google Cloud in Zurich, Switzerland. Other providers process data as the Subprocessors page lists.
Last checked
Can my data stay in Europe or Switzerland?
The self-serve plans run in the United States and carry no data residency promise, and any residency commitment is agreed for a named customer, case by case.
If residency matters to you, tell us about your project. We answer questions about residency, retention and access in writing.
Last checked
Is my data encrypted?
Yes. Every page and API of Talven CX Studio is served over HTTPS, and stored data is encrypted at rest by Google Cloud, and by MongoDB Atlas for the workspaces whose database is still there.
The keys and passwords that our production service uses are kept in Google Secret Manager. When we connect your Web Assistant to one of your own systems, the credentials for that system are stored encrypted.
Last checked
Does Talven hold SOC 2 or ISO 27001?
No. Talven does not hold a third-party security certification, such as SOC 2 or ISO/IEC 27001, today.
The Security page states what is in place instead, control by control.
Last checked
Does CX Studio Manager support single sign-on or two-factor sign-in?
No. Sign-in with a second factor and single sign-on are not available yet for CX Studio Manager.
Each person logs in with their own account, and passwords are stored only as bcrypt hashes. After repeated failed sign-ins, an account is locked for a while. A sign-in lasts at most 30 days, and each person can see where they are signed in.
Last checked
Can Talven staff see my workspace?
Yes. Talven staff can open a workspace's CX Studio Manager to support it, but only from our internal admin, which admits only people we have added as staff.
Last checked
Are there backups?
Yes. The application's cluster is backed up every day, and each backup is kept for 7 days.
Last checked
Which AI models and providers does the Talven Web Assistant use?
Talven lists on its Subprocessors page each provider that writes, checks or speaks the Web Assistant's answers, and the data each one receives.
Read the Subprocessors page.
Visitor messages and your website content go to the providers that do this work. Talven chooses and manages the models. When we add or replace a provider, we update that page and its date.
Last checked
How do I report a security issue?
Email hello@talventech.com with the subject “Security”, and a person reads every message.
Last checked