Security & Data Protection

Client data is stored in the United States. All traffic to and from Goverisyn is encrypted in transit with TLS, and data at rest is encrypted with AES-256.

Users are added by invitation; there is no public sign-up. Two-factor sign-in with an authenticator app is required for every user. Approving the measurement basis and issuing Portfolio Measurement Statements are separate roles, each designated by name; a user without a role can read but cannot approve the basis or issue a statement.

Production data stores are not directly accessible from the browser. Submissions and governance records are accessed only through authorized application functions. Access to production systems and client information is limited according to operational need.

Invitations and password resets are sent from goverisyn.com and signed with DKIM. Each link works once, and only when the recipient confirms on Goverisyn’s own page.

Submissions, approvals, issued records and the audit log are append-only: changes and deletions are refused, so the history of what was submitted and decided is preserved. Issued Portfolio Measurement Statements and issued FP&A feeds are fixed; a change is issued as a new version. Revoking a role records when it was revoked and who revoked it; a designation is never edited or deleted.

Every FP&A feed download is recorded before the file is released. A download that cannot be recorded is refused.

Sign-in activity is recorded: successful and refused sign-ins, two-factor codes, password resets and invitations, each with its time, account, IP address and browser. Passwords and codes are never recorded. Governance actions, including approvals, issues, downloads and role changes, are recorded with who acted and when. The audit log is append-only and covers actions taken within Goverisyn.

Goverisyn uses established third-party infrastructure and service providers to support application hosting, data storage, deployment, email and website operations. Client data is processed only through services required to operate and support Goverisyn.

Details of the material subprocessors that handle client data are provided on request, as part of security and vendor diligence.

Inquiries submitted through this website are handled by SocMedia Digital Management LLC, Goverisyn’s parent company, using its business systems. How that information is used and kept is described in our Privacy Policy.

Goverisyn does not currently hold a SOC 2 report. We answer security questionnaires directly. Questions or concerns: security@goverisyn.com.