SECURITY & TRUST

One security baseline that applies to every institution.

Alvin requires institutional confidentiality, explicitly authorized access and accountable handling of sensitive information across its enterprise and delegation services. These requirements apply to every customer and every authorized user.

YOUR ORGANIZATION’S SECURITY DOCUMENTATION

For documentation related to your enterprise or delegation, including available audit records, sign in to your Portal account and open Settings → Security & Trust. Access is limited to approved contacts for your organization.

MANDATORY STANDARDS

Mandatory security requirements.

Institutional separation, controlled access, confidentiality and accountability are mandatory across Alvin’s enterprise and delegation services. Customer type, users and service scope can vary; the security baseline does not.

01 / DATA BOUNDARIES

Institutional separation

Access to one delegation does not authorize access to another. Sharing across institutions requires separate, explicit authorization.

02 / AUTHORITY

Authorized access

Access requires explicit authorization for the relevant role, information and action. Participation in a delegation does not confer unrestricted access.

03 / CONFIDENTIALITY

Confidential information

Confidentiality requirements apply to documents, communications and operational information throughout the service. Access and handling must reflect the sensitivity of the information.

04 / ACCOUNTABILITY

Accountability

Access must be attributable and revocable. Security issues require documented handling, appropriate escalation and accountable ownership.

INSTITUTIONAL ACCESS

Security and audit documentation for your organization.

Approved contacts can request security policies, privacy documentation and available audit records for the Alvin services their organization uses. For corporate customers, documentation covers their enterprise account and contracted services. For national delegations, it covers their delegation account and authorized activities. Access is determined by customer type, services used and individual permissions.

Internal security procedures and information concerning other customers or delegations remain restricted.

Public policies and reporting

Responsible disclosure ↗

Report a suspected security vulnerability through our documented reporting process.

Read how personal information is handled in connection with Alvin’s services.

Institutional enquiries ↗

Contact Alvin about security diligence and access to relevant documentation.