Who is responsible
Altivy (www.altivy.com, Auckland, New Zealand) is responsible for the personal information in its applications. Unicloud Limited (www.unicloud.co.nz) develops and operates them for Altivy. How personal information is handled is set out in the Privacy Statement; the conditions of use are in the Terms.
Hosting and data residency
The Altivy application, its database and uploaded documents run in Singapore. Where backups and any standby copy are held is read from the hosting record and shown below. AI requests, when an AI feature is used, are processed by Google in the United States.
| Application and database | Railway, Singapore (asia-southeast1), 2 instances behind a health check |
|---|---|
| Operated by | Railway's managed platform, administered by Unicloud |
| Provider | Railway Corp. (United States) |
| Standby copy | None recorded |
| Backups held in | Singapore (Railway) |
Certifications covering the host
| Standard | Held by | Held | Can be provided | Evidence |
|---|---|---|---|---|
| SOC 2 Type 2 | Railway | Yes | No, confidential to the issuer | Examined by Sensiba LLP for 23 April 2025 to 22 April 2026 (Security, Availability, Confidentiality, Processing Integrity and Privacy); report dated 25 August 2026, bridge letter 25 September 2026. Unicloud holds the report; it is confidential and is not passed on. Holder's page |
| SOC 3 | Railway | Yes | Yes, on request | Public summary of the SOC 2 examination; Unicloud can provide it. Holder's page |
| ISO/IEC 27001 | Railway | No | Not applicable | Railway does not hold ISO 27001. Its controls are evidenced by the SOC 2 Type 2 report instead. Holder's page |
Facts checked 24 October 2026 against the documents Unicloud holds.
How security is measured
Every release is assessed against six frameworks on the running application: live probes of its own endpoints, facts read from its database, self-tests of its sign-in and throttling code, static analysis and a production dependency audit. A warning counts as a failure. The latest results:
| Framework | Score | Result | Measured |
|---|---|---|---|
| OWASP Top 10 (web application security) | 100% | 11 of 11 checks pass | 27 October 2026, version 0.3.0 |
| New Zealand Privacy Act 2020 and regulatory | 100% | 12 of 12 checks pass | 27 October 2026, version 0.3.0 |
| GDPR (EU and UK) | 100% | 15 of 15 checks pass | 27 October 2026, version 0.3.0 |
| SOC 2 Trust Services Criteria | 100% | 18 of 18 checks pass | 27 October 2026, version 0.3.0 |
| Server and hosting hardening | 100% | 10 of 10 checks pass | 27 October 2026, version 0.3.0 |
| AI security and governance | 100% | 16 of 16 checks pass | 27 October 2026, version 0.3.0 |
Who processes the data
| Provider | Purpose | Data it receives | Region |
|---|---|---|---|
| Railway | Application hosting, the PostgreSQL database, and the object store for uploaded documents | All platform data | Singapore |
| Vultr | Second hosting site: standby copies of the database and files (only where the hosting record names a Sydney standby) | Standby copies of platform data | Sydney, Australia |
| Cloudflare | Sending transactional email (Email Sending) | Recipient address, subject and message content | Global network (United States head office) |
| SMTP2GO | Transactional email, used only when Cloudflare is not configured or fails (fallback only) | Recipient address, subject and message content | New Zealand |
| Google (Gemini API) | Optional AI features (only when an AI feature is used) | The material an AI feature is asked to work on, with names and identifiers removed first; uploaded files are sent as they are | United States |
| Unicloud (Facilitease control app) | Feedback triage, browser error monitoring, security-assessment reporting, and taking database backups | Feedback items and screenshots, browser error events, assessment results, database backups | Singapore (Railway) |
| Altivy CMS | Flight tracking data for training-record playback | Aircraft registration and flight times | Singapore (Railway) |
Every outbound call the application makes is checked against this register on each assessment; a call to a provider that is not listed fails the assessment.
Reporting a security concern
Email admin@unicloud.co.nz. Suspected privacy breaches are contained and assessed within 24 hours and, where serious harm is possible, notified to the Privacy Commissioner and the people affected.