Skip to content
Olivra

Trust Center

How Olivra protects your compliance program

Trade compliance data is sensitive by nature. These are the controls that protect it, the providers that process it, and the sources we watch for you.

Privacy PolicyContact security
Overview

Olivra builds a company's trade compliance program from its own documents, watches regulatory sources for changes that reach it, and drafts updates for the company to approve. Each company's data is kept separate, every AI-drafted change waits for a person's approval, and the program's history cannot be rewritten.

Controls in place
16
Sources live
14 of 20

Controls

What is in place today. Each one is enforced in Olivra's code or by the provider named.

Access and isolation

  • Company check on every requestBefore any data is read, the request is checked against the signed-in person's company membership.
  • Role-based permissionsOwners and admins approve changes, members work in the program, viewers can only read. Enforced on the server.
  • Verified sign-inEmail verified with a one-time code, or sign-in through Google or Microsoft.
  • Invite-only accessPeople join a company's workspace by invitation from that company.

Data protection

  • Encryption in transit and at restHTTPS for every connection; data encrypted at rest by Supabase and Vercel.
  • Private document storageDocuments open only through signed links that expire within minutes.
  • Encrypted drive credentialsGoogle Drive and OneDrive tokens are encrypted with AES-256-GCM; both connections are read only.
  • Security headersEvery page refuses framing by other sites and content sniffing, and limits what the browser shares.

AI and human control

  • No training on your dataYour documents, data and conversations are not used to train AI models.
  • Nothing changes without approvalEvery change Olive drafts waits for someone at your company to approve it, and the approval is recorded.
  • Cited, grounded answersOlive answers from your own program and the monitored sources, and cites them.
  • No voice recordings keptVoice is streamed to be transcribed and spoken; Olivra stores no audio.

Audit and accountability

  • Immutable audit logDatabase triggers block any edit or deletion of an audit record once it is written.
  • Recorded approvalsWho approved what, and when, is kept with your program's history.
  • Recorded signaturesProgram adoption signatures and training attestations record the signer's name, the time, the IP address and the browser.
  • Honest monitoring statusEach regulatory source below is labeled from real events, not from a hand-kept list.

Subprocessors

Every company that processes customer data for Olivra, each for one job. We don't sell your data, and we share it with no one outside this list.

  • SupabaseDatabase and storage · United StatesHolds account, company, document and program data in a private database and private document storage, and handles sign-in.
  • VercelHosting · United StatesHosts and runs the Olivra application and its scheduled jobs, and counts visits to the public website pages without cookies.
  • AnthropicAI providerReads documents, drafts the program, scores regulatory changes and writes Olive's answers. Under its commercial API terms, content is not used for training.
  • ElevenLabsVoice providerTurns speech into text and Olive's replies into speech during voice conversations. Olivra keeps no recordings.
  • ResendEmail deliveryDelivers invitations, regulatory alerts, summaries and signature requests.
  • StripePaymentsTakes card payments and runs subscriptions. Card details go straight to Stripe and never touch Olivra.
  • Cal.comSchedulingBooks walkthrough calls: receives the name, email and time chosen when someone books.
  • GoogleSign-in and DriveSign-in with Google, and the Google Drive files you choose to import (read only).
  • MicrosoftSign-in and OneDriveSign-in with Microsoft, and the OneDrive files you choose to import (read only).

What we monitor

Olive watches these regulatory sources and maps each change to the sections of your program it reaches. The status is read from real events every hour, not kept by hand.

Live has produced a real change mapped to a program sectionConnected checked on schedule; no mapped change yet
  • BISUnited States · every programLive
  • CBP CSMSUnited States · every programLive
  • CBP Customs BulletinUnited States · every programLive
  • CBSACanada · added for the trade it coversLive
  • Commerce AD/CVDUnited States · every programLive
  • CPSCUnited States · added for the trade it coversLive
  • DHS UFLPAUnited States · every programLive
  • Federal RegisterUnited States · every programLive
  • ITA Screening ListUnited States · every programLive
  • Mexico DOFMexico · added for the trade it coversLive
  • OFACUnited States · every programLive
  • USITC HTSUnited States · every programLive
  • USMCANorth America · added for the trade it coversLive
  • USTRUnited States · every programLive
  • BIS Entity ListUnited States · every programConnected
  • Census export filingUnited States · added for the trade it coversConnected
  • DDTC (ITAR)United States · added for the trade it coversConnected
  • FDAUnited States · added for the trade it coversConnected
  • Presidential trade actionsUnited States · every programConnected
  • WCOInternational · every programConnected

Resources

For a vendor review, a security questionnaire or a question about this page.

Privacy PolicyWhat we collect, why, who processes it, and your rights.Read it Security reviewsWe complete security questionnaires and are glad to sign a mutual NDA before a technical review.security@olivra.ioReport a vulnerabilityFound a security issue? Tell us privately and we will look into it right away.security@olivra.io