Introduction

This document contains a comprehensive overview of Vivun's Security and Privacy program and controls impacting Ava, the AI Sales Teammate. It is for Vivun prospects and customers who want information about our controls in order to perform their respective due diligence and vendor risk assessments.

Our programs encompass controls across Vivun's infrastructure, product security, integrations, operational security, and compliance. To access security and compliance documents, reports, and certificates, please visit our Trust Center.

1. Product Overview

What is Ava?

Ava is Vivun's AI Sales Teammate that helps B2B technology companies accelerate complex sales cycles by transforming deal data into actionable guidance and sales-ready outputs. Built on Vivun's proprietary Sales Reasoning Model and Agent Intelligence architecture, Ava acts as an intelligent teammate that automates critical sales work, provides expert-level coaching, and ensures consistent execution across your revenue organization.

Developed in-house with enterprise-grade security at every layer, Ava integrates seamlessly with your existing systems while maintaining the highest standards for data protection and compliance. Here's how it works:

• Ava captures and processes deal context from your Salesforce CRM, communication platforms, and customer interactions—analyzing conversations, opportunity data, account information, and product requirements to build a comprehensive understanding of each deal.
• Ava applies domain expertise through structured reasoning using Vivun's proprietary Sales Reasoning Model, which codifies expert sales knowledge into ontologies, layered memory, and transparent logic to interpret context, make autonomous decisions, and execute proactively across the deal cycle.
• Ava generates high-quality, sales-ready outputs including value propositions, competitive responses, technical documentation, and stakeholder engagement plans—transforming expert seller knowledge into consistent, actionable materials that move deals forward.
• Ava provides on-call assistance and coaching by offering real-time guidance throughout the deal cycle, answering technical questions, addressing objections, and helping reps navigate complex sales situations with expert-level support.
• Finally, Ava delivers insights that drive continuous improvement by analyzing deal patterns, identifying risks early, and helping teams replicate the behaviors and strategies of top performers across the entire sales organization.

Ava's Value At-A-Glance

Ava enables sales teams to close more deals faster by combining AI-powered automation with deep sales domain expertise. Unlike generic AI assistants or conversation intelligence tools, Ava proactively executes sales tasks, generates high-quality outputs, and scales expert-level guidance to every rep—all while maintaining enterprise-grade security, comprehensive compliance certifications (SOC 2 Type 2, ISO 27001, GDPR, and ISO 42001 alignment), and granular controls that give you confidence your sensitive sales data is protected.

4. Product Security

Ava is built with security by design and by default principles throughout its architecture. The platform implements comprehensive technical and organizational measures that ensure appropriate levels of security for customer data.

User Provisioning and Management

Automatic User Provisioning

By default, users are automatically created and added when they login and access Ava for the first time through Salesforce authentication. Manual user provisioning is only required if the organization uses allowlisting for access control.

Administrator-Controlled Management

Organization Admins manage users through the User Management interface with the ability to:

• Add and remove users (individually or in bulk)
• Update user roles and permissions
• View all users and their activity status

Login Security

Salesforce Social Login

Ava uses Salesforce social login to authenticate user credentials. Users must be logged into their Salesforce organization prior to accessing Ava, as authentication occurs through the Salesforce connection via a Connected App called "Vivun Ava Prod Auth0".

Data Control

Role-Based Access Control (RBAC)

Ava implements a three-tier role-based permission system:

• Standard User: Access to Spaces and individual integrations
• Trainer: All Standard user functionality plus Training features
• Admin: All Trainer functionality plus User Management and organization-wide integrations

Salesforce-Based Data Access

User access to Opportunities and Accounts is determined by Salesforce Account and Opportunity Team membership. Users automatically get access to Spaces for Opportunities where they are part of the team in Salesforce.

Data Retention and Deletion

Key Retention Policies:

• Data retained during active subscription to provide Services
• Lookback period: Up to 300 days for Zoom recordings
• Post-termination: All data destroyed within 120 days
• Backup retention follows standard AWS processes
• Customer data never used to train third-party or proprietary AI models

5. Artificial Intelligence

Vivun is committed to the responsible and ethical use of artificial intelligence to deliver value to customers while prioritizing their privacy, security, and trust.

AI Principles

Vivun Models

The Sales Reasoning Model

Vivun's proprietary intelligence engine that codifies expert sales knowledge into ontologies, layered memory, and transparent logic, enabling Ava to interpret context, make autonomous decisions, and proactively execute across the deal cycle.

Key Components:

• Domain-Specific Ontologies
• Layered Memory (short-term, medium-term, long-term)
• Transparent Logic
• Knowledge Graphs

Agent Intelligence

Vivun's proprietary architecture that enables AI to think, act, and improve like a real team member rather than functioning as a passive tool.

AI Governance

ISO/IEC 42001 Alignment

Vivun's AI management system is aligned with ISO 42001, the world's first international standard for Artificial Intelligence Management Systems. The framework encompasses ten core objectives:

1. Data Protection and Security
2. Secure AI Development and Deployment
3. Full Legal and Regulatory Compliance
4. System Availability and Reliability
5. Access Control and Monitoring
6. Commitment to Promoting Secure AI Use
7. Incident Response and Recovery
8. Continuous Improvement and Risk Management
9. Transparency and Accountability
10. Collaboration and Communication

Contractual Restrictions on AI Use

Human Oversight and Decision-Making

Vivun leverages natural language processing (NLP) and AI to assist users in making informed decisions while minimizing potential bias. Human users remain in control of decision-making. AI augments rather than dictates outcomes, reducing the risk of bias and maintaining transparency.

7. Certifications & Compliance

Vivun maintains comprehensive compliance certifications and adheres to the highest standards of data protection and security.

GDPR Compliance

Vivun maintains full compliance with the General Data Protection Regulation (GDPR). Customer data is strictly used only for purposes defined within agreed contract terms, protected with encryption in transit and at rest, and retained only as long as necessary.

Compliance Certifications

ISO 42001: Artificial Intelligence Management Systems

Vivun's AI governance framework aligns with ISO 42001, the world's first international standard for Artificial Intelligence Management Systems. With only a handful of organizations globally certified as of 2025, alignment with ISO 42001 demonstrates leadership in responsible AI practices.

ISO 27001: Information Security Management Systems

Vivun maintains ISO 27001 certification, the internationally recognized standard for Information Security Management Systems. With over 70,000 certificates issued across 150 countries, ISO 27001 is often required by B2B clients in IT, healthcare, and finance sectors.

SOC 2 Type 1 and Type 2

• SOC 2 Type 1: Validates that security controls are properly designed and in place
• SOC 2 Type 2: Validates strict adherence to security, confidentiality, and availability practices over an extended operational period

Vivun undergoes annual SOC 2 Type 2 audits covering security, availability, and confidentiality trust services criteria.

Standard Contractual Clauses

Vivun implements Standard Contractual Clauses (SCCs) to ensure lawful cross-border data transfers when customer personal data protected by GDPR or UK GDPR is transferred outside the European Economic Area (EEA) or United Kingdom.

Key Provisions:

• Government Access Requests: Vivun notifies customers of any requests
• Sub-Processor Requirements: Written agreements with data protection obligations
• Customer Objection Rights: 30-day window to object to new sub-processors
• Alternative Mechanisms: Automatic replacement if newer transfer mechanisms become available

Data Privacy Framework

Processing Locations: Customer personal data may be transferred and processed in the United States and other locations where Vivun or sub-processors maintain operations.

Storage Location: Amazon Web Services US-WEST region

Transfer Risk Assessment: Based on analysis of US surveillance laws, the risk of government access to customer data is assessed as low for commercial sales intelligence platforms.

About Vivun

Vivun delivers Ava, the AI Sales Teammate for high-velocity sales teams that sells with you and unlocks instant capacity. Powered by a proprietary Sales Reasoning Model, Ava provides real-time guidance before, during, and after calls through text, voice, or avatar. By helping sellers work smarter, faster, and better, Ava saves reps 6-8 hours per week—freeing teams to focus on driving growth.

For more information about Ava security and compliance, please visit the
Trust Center