Clear controls for your business data.
The diagnostic starts with public market information. Other tools can use material you submit or connections agreed for your workflow. Your plan and setup determine the available actions and approval steps. Our data-handling commitments and current compliance status are explained below.
Security questions: privacy@ontevo.ai. A person replies, usually the same day and always inside one business day.
Last updated: 23 September 2026.
What the diagnostic uses, and what other tools may need.
The diagnostic starts with public customer, market and competitor information. It does not require access to your internal systems. Uploads and connections are separate choices for the tools or workflows you use.
What it reads.
Your public pages and your competitors' public pages. Google and Apple Maps listings. Marketplace pages, spec sheets and posted prices. Reviews on Google, Amazon and Trustpilot. Search rankings, backlinks and the ads running in the Meta and Google ad libraries. Page speed. And what AI assistants answer when a buyer asks about your category. All of it is already visible to your customers.
What the diagnostic does not require.
The diagnostic does not require passwords, customer records or a connection to your CRM, point of sale or practice management system. Other tools may use material you choose to submit or a separately scoped connection. Our Terms prohibit submitting protected health information.
Where it sits.
Scan outputs are processed and stored in the United States and encrypted in transit and at rest. Customer data is logically separated per account.
What we hold, and for how long.
Scan outputs, account and billing details, usage information, and material you choose to submit through the tools you use. Connected workflows are scoped separately. Our no-training commitment applies to your business data. Benchmarks and research we publish are built only from public data we gather. Anything you upload, connect or enter, including revenue estimates, is your Customer Data. We use it only to provide the service to you. It is never sold, never shared with other customers, never aggregated or anonymized into benchmarks or research, and never used to train AI models. We keep it only as long as needed to provide the service and delete it on request or within 90 days after your account closes. The Privacy Policy explains data handling and retention.
Benchmarks come from public market records, never from another customer's data.
What is in place today.
A summary of the data, access and product controls described in our policies.
Data.
Your data is encrypted in transit and at rest, processed and stored in the United States, and logically separated per account.
Payment card numbers are never stored on our servers: billing is handled by Stripe, which maintains PCI DSS Level 1 compliance, and our cloud infrastructure providers maintain ISO 27001 certification.
Access.
Access to customer data is role-based and limited to authorized personnel, and sign-in is handled by a dedicated identity provider rather than one we built.
Product.
The diagnostic starts from public information. Drafting tools prepare work for your review; separately scoped automation follows the controls agreed for that workflow.
Commitments in writing.
We do not sell your business data, use it to train models, or share it with other customers, advertisers or data brokers. Our policies explain service-provider processing, and our Terms prohibit submitting protected health information.
Breach notice: no later than 72 hours after we confirm an incident.
Review drafts and agree controls for automation.
Evo Agents prepare work such as review responses, listing updates and follow-ups for your team to review. Any separately scoped automation follows the controls agreed for that workflow. Available actions and approval steps depend on the agent, your plan and setup.
Review the proposed actions and access required when scoping a connected workflow. Contact us to confirm what is included for your account.
COMPLIANCE STATUS
Where we are, and where we are not.
SOC 2 Type I and HIPAA readiness are in progress. We do not currently hold a SOC 2 report, and we will not say we do until the report is in hand.
Ontevo does not currently offer a HIPAA Business Associate Agreement. Our Terms prohibit submitting protected health information. Contact privacy@ontevo.ai if your compliance team needs a statement about the diagnostic’s scope.
We will update this page as our compliance status changes.
UPDATES
15 SEPTEMBER 2026
This page published, with the controls, the documents we send to a security reviewer and the current compliance status in one place.
4 AUGUST 2026
Privacy Policy and Terms of Service published, with the no-training commitment written into the Terms as a contractual term.
ON REQUEST
What we send a security reviewer.
Write to privacy@ontevo.ai with your company name and what your process needs. A person replies, usually the same day and always inside one business day.
Data processing agreement.
A data processing agreement is available on request for portfolio and enterprise customers. It covers the standard processor terms, including breach notice, deletion and audit rights.
Security questionnaires.
We complete vendor security questionnaires, including CAIQ-style ones. Send yours and we will return it filled in, with the unanswered rows marked as unanswered rather than guessed.
Sub-processors.
A current description of the third-party service providers material to your account is available on request at privacy@ontevo.ai. It names the vendor, what it does, and what it touches.
FAQ
The questions a security review actually asks.
No. SOC 2 Type I and HIPAA readiness are in progress. We do not currently hold a SOC 2 report. We will not claim one until the report is in hand.
No. Ontevo does not currently offer a HIPAA Business Associate Agreement. The diagnostic uses public information and does not require access to a practice management system. The Terms prohibit submitting protected health information. Contact privacy@ontevo.ai if your compliance team needs a statement about the diagnostic’s scope.
Scan outputs about your business and competitors, account and billing details, usage information, and material you choose to submit through the tools you use. Connected workflows are scoped separately. Benchmarks and research we publish are built only from public data we gather. Anything you upload, connect or enter, including revenue estimates, is your Customer Data. We use it only to provide the service to you. It is never sold, never shared with other customers, never aggregated or anonymized into benchmarks or research, and never used to train AI models. We keep it only as long as needed to provide the service and delete it on request or within 90 days after your account closes. The Privacy Policy explains data handling and retention.
Scan outputs are processed and stored in the United States. Data is encrypted in transit and at rest and logically separated per account.
Never. Your competitive intelligence stays yours. It is a term in our Terms of Service, on every plan, and it applies on the third-party model services we use to deliver analysis.
Drafting tools prepare work for your review. Any separately scoped automation follows the controls agreed for that workflow. Available actions and approval steps depend on the agent, your plan and setup.
Ontevo will notify affected customers without undue delay and no later than 72 hours after we confirm an incident involving customer data, with a plain-language description of what happened, what data was involved, and what the customer should do. The clock starts at confirmation, not at occurrence.
Billing is handled by Stripe, which maintains PCI DSS Level 1 compliance. Our platform runs on enterprise cloud infrastructure whose providers maintain ISO 27001 certification. Certain analysis features are delivered using third-party AI model services, and our no-training commitment applies there too. A current description of the third-party service providers material to your account is available on request at privacy@ontevo.ai.
Bring us your security review.
If your process needs a questionnaire filled in, a DPA signed or a call with the person who built the system, book fifteen minutes. If you would rather see the product first, the Rapid Scan needs your website and your email and nothing else.