Every security capability is included in every plan — not sold as an add-on, not reserved for Enterprise. UK/EU data residency, GDPR-ready workflows, eIDAS e-signatures, 2FA, role-based access, and a full audit trail for every action.
UK and EU data residency. Encrypted in transit and at rest. Soft-delete retention with configurable policies. Full export of your data at any time, in open formats.
TOTP 2FA with backup codes. Role-based access control with department scoping. Session timeouts and forced password resets. Comprehensive audit log for every change.
GDPR-ready DSAR, breach, DPIA and consent workflows. eIDAS-compliant e-signatures with signing order and secure tokens. Email compliance with unsubscribe and reputation monitoring.
Webhook signature verification via Svix. PII hashing and secure token handling. Content snapshots on contract close — immutable record. Configurable backup and retention.
TOTP with QR setup, backup codes, and brute-force lockout. Configurable session timeouts with forced password resets. 2FA can be enforced organisation-wide.
Permission matrix with department scoping and per-role overrides. Data visibility is scoped by department membership. Guest access for external users with limited permissions.
Every create, update, and delete logged with user, timestamp, and change detail. Configurable retention. Searchable and exportable for compliance reviews.
Configurable session timeouts. Forced password resets when required. Admins can terminate individual sessions. Login attempts throttled to prevent brute force.
Customer data is hosted in UK and EU regions. For UK and EU firms, no cross-border transfer is required. Hosting location can be confirmed during a security review.
Yes. Avaro ships a GDPR suite covering data-subject access requests (DSAR), breach tracking with notification workflows, DPIA templates, and consent management. Every change is recorded in the audit log.
Yes. Native e-signatures are eIDAS-compliant, with multi-signatory support, signing order enforcement, secure tokens, and a tamper-proof audit trail. No external DocuSign or PandaDoc is required.
Yes. TOTP-based 2FA with backup codes can be enforced organisation-wide. Sessions time out to a configurable policy, and admins can force password resets when required.
Role-based access control with a permission matrix, department scoping (records are scoped to the user’s department unless granted wider access), and a separate guest-access model for external users (the client portal).
Yes. Full data export at any time in open formats (CSV, JSON). No export fee. No retention lock-in. This is a line item in our pricing — portability is not sold separately.
Yes. Data Processing Agreement, security overview, and sub-processor list are available on request. Enterprise customers receive bespoke documentation as part of onboarding.
Talk to our team about your specific requirements. We’ll walk you through controls, provide documentation, and answer procurement questions directly.