Security summary
For IT teams, counsel and anyone reviewing Civinti before it touches your organization's information. Updated October 2026.
Access and sign-in
- People sign in with their Microsoft work accounts through Microsoft Entra ID. Your organization's own rules apply, including multi-factor authentication.
- Access is by invitation only. Removing someone from your Microsoft directory removes their access to Civinti.
- Every request to Civinti's servers carries a sign-in token that is verified on the server before any data is read, any connected system is called or any AI request is made.
Where data lives
- Civinti runs on Microsoft Azure.
- Data is encrypted in transit (HTTPS) and at rest (Azure Storage encryption).
- Each person's conversations, projects and uploaded files are stored under their own identity and can only be reached by them.
- Uploaded files are checked by type and content and limited in size before they are stored.
- Passwords and access keys for connected systems are held on the server and never sent to the browser.
- Your organization owns its data. At the end of service, we return it on request and then delete it.
How the AI is used
- The assistant answers from the information it is given: your tasks, calendar, email summaries and documents. When the information isn't there, it says so.
- Requests go to our AI provider through its business API, which does not use customer data to train its models.
- Content inside emails and documents is treated as information, never as instructions to the assistant.
- The AI prepares drafts. Emails, meeting invites and changes are sent only after a person reviews them and clicks send.
- Sent emails and meeting changes are recorded in an activity log.
Connected systems
Civinti connects only to the systems your organization chooses, with the narrowest access that does the job.
| System | Access |
|---|---|
| Microsoft 365 email and calendar | The signed-in person's own mailbox and calendar only, with permissions approved by your administrator |
| Task management (for example, Wrike) | A folder or project your organization designates |
| Automated workflows | Separate, revocable credentials for each workflow, so any one can be switched off without affecting the rest |
Automations and AI agents
- Each automation and agent runs with its own credentials, limited to the access it needs, and can be revoked on its own.
- Every run is recorded: when it ran and what it did.
- Your administrators can pause any automation or agent from the Client Portal.
- A person approves anything an agent would send outside your organization.
Records and retention
Conversations and documents in Civinti can be records your organization must keep or produce. Public agencies follow their public records laws, and private organizations follow their own retention policies. Either way, we agree on retention, export and deletion with you during Discovery & Assessment, before Civinti is used with your information.
Our standard safeguards
- Microsoft sign-in with multi-factor authentication
- Server-side verification of every request
- Per-person data separation
- Encryption in transit and at rest
- Human approval before anything is sent
- Activity log of sent emails, meeting changes and automation runs
- Malware scanning of uploaded files
- Separate connections to each system for each person
- A Client Portal where administrators manage users and pause automations and agents
Reporting a concern
If you believe you've found a security issue, email contact@civinti.ai with "Security concern" in the subject.