Compliance & Security

Aiivars LLC, an Arizona limited liability company doing business as TechManager AI, is committed to maintaining robust security practices and supporting our customers' compliance requirements.

Security Standards

TechManager AI implements security controls aligned with industry standards:

• SOC 2 Type II - Controls implementation in progress
• HIPAA - Designed to support HIPAA-aligned workflows; Business Associate Agreement (BAA) available upon request for qualifying customers

Note: Compliance is a shared responsibility. Our platform provides tools and controls to support your compliance efforts, but achieving compliance depends on how you configure and use our services.

Data Protection

We implement comprehensive security measures including:

• Encryption for data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Multi-factor authentication (MFA)
• SSO integration via OAuth 2.0 / OIDC / SAML
• Security audits and penetration testing (planned)
• Complete audit trails and logging
• Role-based access control (RBAC)

Data Isolation

Customer data is logically isolated using row-level tenant and user-level security:

• Row-level tenant isolation, each organization's data is scoped and enforced at the database level
• User-level access controls, permissions are enforced per user within each organization
• No cross-tenant data access, queries are restricted to the authenticated tenant's data
• Encrypted at rest (AES-256) and in transit (TLS 1.2 or higher)

Privacy Law Support

Our platform is designed to support compliance with applicable privacy laws, including CCPA/CPRA:

• We do not sell personal information
• Tools to support data subject access requests (DSAR)
• Data export and deletion capabilities
• Non-discrimination for exercising privacy rights

On-Premise Deployment

For customers requiring complete data sovereignty, on-premise deployment with private LLM options is coming soon. Contact us to learn more or join the waitlist.

Incident Response

We will notify affected customers within 72 hours of discovering any security incident affecting their data, in compliance with applicable breach notification laws. Enterprise customers may have access to dedicated incident response SLAs.

Responsible Disclosure Policy

We value the security research community and encourage responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to us:

• Email: security@techmanager.ai
• Please include detailed steps to reproduce the issue
• Allow us reasonable time to investigate and address the issue before public disclosure
• Do not access or modify data belonging to other users

We will acknowledge receipt of your report within 48 hours and work with you to understand and resolve the issue promptly.

Subprocessors

We use the following third-party subprocessors to deliver our services:

Note: Google Analytics, Google Tag Manager, Tawk.to, and Cal.com are used only on our public marketing website or for B2B scheduling and do not process Protected Health Information (PHI).

^* “Verification pending” means we have not yet confirmed and executed a BAA with that provider — not that one is unavailable. For HIPAA-covered workloads we route Customer Data only to providers with an executed BAA, so until each is confirmed, do not send Protected Health Information through the platform. Contact legal@techmanager.ai for current status.

For HIPAA-covered customers, we execute Business Associate Agreements (BAAs) with all subprocessors that may access PHI. We will notify customers of any material changes to our subprocessor list with at least 30 days' notice.

Enterprise customers may request the complete subprocessor list with additional details by contacting security@techmanager.ai.

How Customer Data Reaches Our LLM Providers

TechManager AI uses a single large language model provider: Anthropic (Claude). Customer Data sent to Anthropic is processed in its US-based enterprise environment and is not used to train general-purpose models, per Anthropic's API and commercial terms. For HIPAA-covered workloads, only a provider with an executed BAA receives Protected Health Information.

We name one provider rather than a category deliberately, so you can evaluate it. If we add a second, it will appear in the table above before it processes anything, and customers receive 30 days' notice under DPA §7.4 — time enough to object.

Geographic Scope

TechManager AI services are intended for businesses operating in the United States. All Customer Data is processed and stored in the United States. We do not actively market to or serve customers outside the United States.

Related Policies

This Compliance & Security overview should be read together with the following documents, which form one cohesive policy set:

• Terms of Service — service agreement, acceptable use, billing
• Privacy Policy — data collection, retention, US state privacy rights
• Data Processing Agreement — processor obligations, breach notification, audit rights

Contact

For compliance, security, or data protection questions:

Security Team: security@techmanager.ai
Privacy/DPO: privacy@techmanager.ai
Legal: legal@techmanager.ai
Company: Aiivars LLC