Trust Center
How we handle security, privacy, AI safety and honest reporting.
Security controls
- Multi-factor authentication required for every administrative feature
- Re-authentication within 10 minutes for role changes, PII exports and production approvals
- Strict content security policy, HSTS and same-origin APIs
- Encrypted MFA secrets; hashed session tokens; scrypt password hashing
- Audit log of every sensitive action with before and after values
Privacy
- Exports mask requester personal data by default
- Subscriptions use double opt-in and one-click unsubscribe
- Scholarion and OakHaven Global University share no learner data
- Analytics only after consent
Questions
- Is Haven SOC 2 or ISO 27001 certified?
- Not yet. No certification is claimed until an independent audit is complete. Our controls are designed to support SOC 2, ISO 27001 and Nigeria’s NDPA.
- How do you separate customer data?
- Every operational table is protected by PostgreSQL row-level security scoped to brand and tenant, so a missing filter in code still cannot leak another tenant’s rows.
- Do agents act on their own?
- No. Elysian and brand agents propose actions as confirmation cards; a person approves anything consequential, and every action is audited.
- Where do your numbers come from?
- Outcome metrics appear only with an evidence record. Without one we show the target and how it will be measured. Demo screens are watermarked.
- Is any of this medical or investment advice?
- No. MediGrid keeps a pharmacist in the loop and gives no AI clinical advice. Haven Trading defaults to paper trading and is not investment advice.