How we protect organization and client data day to day.

Workspaces can be provisioned in the EU (Frankfurt), the GCC (Bahrain), the US (Virginia), Canada (Central), Singapore, or Sydney. Customer organizations choose the region at signup; data does not leave the chosen region for primary storage.

Disaster-recovery replicas live within the same continent. Cross-region replication is opt-in and disclosed in the Order Form.

All traffic uses TLS 1.2 or higher. At rest, data is encrypted with AES-256 keys managed in the regional cloud provider's key-management service. Customer documents are stored in encrypted object storage with versioning enabled.

Workspaces are isolated by organization. Inside an organization, role-based permissions cover Owner, Manager, Sales, Finance, and Client roles, with custom roles available on Corporate and Private packages. SSO via Google Workspace, Microsoft Entra ID, and SAML is available.

Internal 4invest access to customer data follows least-privilege. Production access requires named approval, and every action is logged in an immutable audit trail.

Multi-factor authentication is available for every account and enforced for Owner roles. Session timeouts are configurable per organization. Password hashing uses Argon2id.

Every approval, reservation, document change, and permission change is recorded with actor, timestamp, and previous state. Logs are exportable from the workspace and retained as described in the Privacy Policy.

Internal dependency scanning runs continuously. Critical CVE patching SLA is 14 days from public disclosure, faster when actively exploited. We accept responsible-disclosure reports at security@4invest.co and respond within two business days.

4invest is preparing for SOC 2 Type II attestation. The current state — controls in place, controls in preparation, and the auditor partner — is published openly on the status page. We will not claim "SOC 2 compliant" until the report is signed.

Operational incidents are tracked at status.4invest.co. Security incidents that affect customer data trigger the notification timeline described in the GDPR Statement.