Downloads
Aug 20, 2026
These FAQs explain how Avionté protects customer data, covering data protection, compliance, access control, incident response, and employee training. To request the SOC 2 Type II report or ask a question not covered here, email security@avionte.com or use this form.
Data Security and Storage
1. What types of data encryption are used for data at rest and in transit?
Avionté encrypts customer data at rest with AES-256 and in transit with TLS.
2. How is data segregated within the AWS infrastructure to ensure customer privacy?
Each customer’s data is logically separated within Avionté’s cloud environment, and access is limited through role-based permissions.
3. How does Avionté handle data ownership and customer access to data?
Customers retain ownership of their data and can access and export it through the Avionté platform. Support is available if assistance is needed.
4. What protocols does Avionté use for secure data deletion?
Avionté follows cloud provider best practices for secure data deletion so that deleted data is not recoverable.
Business Continuity and Disaster Recovery
5. What is Avionté’s disaster recovery plan for data stored in AWS?
Avionté maintains a documented disaster recovery plan, including encrypted backups replicated across regions.
6. How often are disaster recovery drills conducted?
Avionté tests its disaster recovery procedures at least annually.
7. How does Avionté ensure resilience against regional outages within AWS?
Avionté hosts on AWS using redundant infrastructure and cross-region backups to support service availability.
Compliance and Certifications
8. Is Avionté HIPAA-compliant, and how does it protect healthcare-related data?
Avionté provides staffing software and is not a healthcare-specific platform. Customer data is protected with encryption and access controls. For HIPAA-related questions, please contact your Avionté account team.
9. Does Avionté comply with the GDPR for customers based in the EU?
Avionté aligns its privacy practices with the GDPR and other applicable privacy laws, including support for data access and deletion requests.
10. What types of audits are conducted to ensure Avionté’s compliance with SOC 2 standards?
Avionté holds a SOC 2 Type II attestation covering Security, Availability, and Privacy since 2022. An independent third-party auditor examines Avionté’s controls every year, and the report is available on request.
11. How does Avionté stay updated with changes in regulatory requirements?
Avionté reviews regulatory changes with legal counsel and updates its policies and practices as needed.
Access Control and Authentication
12. What authentication methods are used to secure access to Avionté’s platform?
Avionté uses multi-factor authentication to protect access to its systems and supports single sign-on for customers.
13. How does Avionté enforce the principle of least privilege across its systems?
Avionté grants access by role, limited to what each person needs for their job, and reviews access on a regular schedule.
14. Does Avionté support Single Sign-On (SSO) for user authentication?
Yes. Avionté supports single sign-on so customers can use their existing identity provider.
Network Security
15. How does Avionté protect its network from external threats?
Avionté protects its network with firewalls, continuous monitoring, and regular vulnerability assessments.
16. What protection measures are in place against Distributed Denial of Service (DDoS) attacks?
Avionté uses DDoS protection services to help maintain availability during malicious traffic.
17. What measures are in place to secure data transmitted over public networks?
Avionté encrypts data transmitted over public networks using TLS.
18. How does Avionté handle firewall configuration and monitoring?
Firewalls are configured and monitored on an ongoing basis to prevent unauthorized access and detect anomalies.
Incident Response and Threat Detection
19. How does Avionté monitor for security incidents?
A managed security operations center monitors Avionté’s environment 24/7, and alerts reach the security team in real time.
20. What is the process for notifying customers in the event of a data breach?
Avionté will notify affected customers of a confirmed data breach without undue delay, in line with legal, regulatory, and contractual requirements.
21. What kind of logging and monitoring does Avionté implement for threat detection?
Avionté centrally logs and monitors system activity to detect and investigate potential threats.
22. Does Avionté conduct tabletop exercises to prepare for potential security incidents?
Yes. Avionté periodically conducts tabletop exercises to test and improve its incident response.
Vulnerability Management and Patching
23. Does Avionté conduct regular vulnerability scans on its systems?
Yes. Avionté performs regular vulnerability scanning and annual third-party penetration testing.
24. How are critical vulnerabilities prioritized for remediation?
Avionté uses a risk-based approach and addresses the most severe vulnerabilities first.
25. How does Avionté manage third-party dependencies and patching?
Avionté monitors third-party components for known vulnerabilities and applies patches based on risk.
26. What tools does Avionté use for vulnerability scanning?
Avionté uses established security tools for vulnerability scanning and tracks findings through remediation.
Customer Data Management and Retention
27. How long does Avionté retain customer data after contract termination?
Customer data is retained for a limited period after contract termination to allow for export, then securely deleted, as set out in the customer agreement.
28. Can customers request data deletion, and how is this request processed?
Yes. Customers can request deletion of their data, and Avionté securely deletes it in line with legal and contractual requirements.
29. Can customers request an export of their data in a specific format?
Yes. Avionté supports data export in common formats such as CSV or JSON.
30. How does Avionté handle data archiving for long-term retention?
Avionté retains and archives data in line with its data retention policy and customer agreements.
Third-Party Integrations and API Security
31. How does Avionté secure data exchanged with third-party integrations?
Avionté uses secure APIs with token-based authentication and TLS to protect data exchanged with third-party systems.
32. Does Avionté offer any tools for customers to monitor API usage?
Avionté monitors API usage to detect abuse and protect the platform. For questions about your API activity, please contact Support.
33. How does Avionté ensure third-party integrations do not compromise system security?
Avionté evaluates third-party integrations for security risk and applies strict API permissions and security controls.
34. Are API usage limits and throttling policies enforced?
Yes. Avionté applies API rate limits and throttling to prevent abuse and protect platform availability.
Employee Security Awareness and Training
35. How often does Avionté conduct security training for its employees?
All employees complete security awareness training and take part in ongoing phishing simulations. Employees who handle sensitive data receive additional training.
36. Are employees required to report suspicious activity?
Yes. Avionté requires employees to report suspicious activity.
37. How does Avionté ensure that employees understand data privacy requirements?
Avionté provides training on data privacy requirements and the responsible handling of customer data.
38. Are employees subjected to background checks before handling sensitive information?
Yes. Avionté conducts background checks on employees who access sensitive information, as part of its hiring process.
Additional Security Questions
39. How do I request Avionté’s SOC 2 Type II report or other security documentation?
Email security@avionte.com or use the Contact the Security Team form, and the team will follow up.
40. Does Avionté have an incident response plan?
Yes. Avionté maintains a documented incident response plan, including customer notification procedures, and tests it through tabletop exercises.
41. Where is Avionté hosted?
Avionté is a cloud-native SaaS platform hosted on Amazon Web Services (AWS), with no on-premises data centers.
42. Does Avionté carry cyber insurance?
Yes. Avionté carries cyber insurance, and certificates are available on request.
43. How does Avionté handle payment card data?
Avionté processes payments through a PCI-compliant third party and does not store cardholder data.
44. How does Avionté govern the use of AI?
Avionté maintains an executive-approved AI Security Policy and an inventory of approved AI tools and use cases.
45. How do I report a security vulnerability to Avionté?
Email security@avionte.com with the details, and the security team will review the report.
46. Where can I check Avionté’s platform status?
Real-time platform status is available at status.avionte.com.
