Trust Center
Blivo holds your company's data and its daily work. This page describes exactly how that trust is protected. Where something is not ready, it says so plainly.
Controls that are implemented and active, described exactly.
What we collect, what we never touch, and where data lives.
Boundaries, human control, and enforced escalation.
Backups, verification, restore drills, and health checks.
How the platform is built, tested, and verified.
What shipped, when, and how it was verified.
Privacy
What Blivo collects, and why. In plain words.
Your account details, the company data you enter, and records of actions taken in the platform. Nothing else.
No trackers, no advertising cookies, no external analytics, no selling or sharing of data. Our business is subscriptions, not ads.
On our own servers, isolated per company, in databases we control. No third-party cloud data stores.
To do AI work, the platform sends the necessary request context to its AI provider. Your data is never used to train models, and the provider relationship is governed by our data terms.
A company owner can delete business data within the published restore window. Action records remain, as an accounting trail, but contain no file contents.
Infrastructure
The architecture, at a level that's safe to publish.
Blivo runs on a single dedicated server we administer, not a shared hosting platform. The database, the application, and the files live on it.
The database, the cache, and the internal services accept connections only from the server itself. To the public internet, only the web ports exist.
Every hostname serves HTTPS with a certificate from a public certificate authority, issued and renewed automatically by the reverse proxy. HTTP redirects to HTTPS.
Every query is scoped to your company by the server, not by the client. A request for another company's data returns the same answer as a request for something that doesn't exist.
Keys and credentials live in protected configuration on the server, never in the source code, never in the repository.
Reliability
How your data is protected against loss, and how you can check it.
Engineering
How the platform is built and verified, honestly.
Every change passes the automated test suite: unit tests, integration tests against a real database, and route-level checks. A failing test stops the release.
The API, the application, and the website are all strictly typed, and type errors fail the build. Whole classes of bugs don't reach production.
Every deployment is followed by live checks against the real service: pages, API routes, and health endpoints. A deploy that can't be verified is rolled back.
The record of every action cannot be edited or deleted by anyone, including us. It's the same for every company on the platform.
When something isn't configured or can't happen, the platform says exactly that. There is no code path that fabricates a success.
Release reports
Every significant release, what it changed, and how it was verified. This is the structure every future report follows.
The public site moved to the premium dark design with both languages rendering in the same fixed direction. The Help Center launched at support.blivoai.com with 24 articles in two languages.
Full responsive audit across seven widths and both locales, link and SEO checks, and live verification of every route on the production server.
Complete public website rewrite in the owner's language: a sixteen-section story from problem to outcomes, a Trust Center with honest statuses, and live pricing.
Automated overflow checks on nine pages in two locales, search and metadata validation, and an independent visual design review before deployment.
The platform moved to its own server, serving all surfaces directly on the standard web ports, with automated backups, backup verification, and weekly restore drills.
Every public route and API endpoint verified live from outside the server, database restored from the production backup and reconciled.
Older infrastructure releases are summarized in the repository history. Reports for future releases will be published here first.
Current status
| Capability | Status |
|---|---|
| Data isolation between companies | Configured |
| Password and session protection | Configured |
| Append-only action records | Configured |
| Daily backups with verification and restore drills | Configured |
| Human approval gates | Configured |
| HTTPS with automatic certificates on all hostnames | Configured |
| WhatsApp delivery | Ready, needs your provider account |
| Telegram delivery | Ready, needs your provider account |
| Email delivery | Not configured yet |
| Instagram and Facebook delivery | Coming soon |
| SMS and phone delivery | Not currently supported |
| Multi-factor sign-in | Coming soon |
| Breached-password screening | Coming soon |
| Security certifications (SOC 2, ISO) | Not held; never claimed |
Security roadmap
Our plan for independent validation, stated in public so you can hold us to it.
Every release passes the automated security-relevant test suite: isolation between companies, session integrity, brute-force lockouts, and financial invariants. Deployments are verified live before being declared done.
Both are designed and scheduled. MFA will be offered per account, and sign-up will screen new passwords against known-breach lists. This page will say 'configured' the day they ship.
We plan an external penetration test by an independent firm, with the report summarized here, findings and fixes included. We will not claim it before it exists.
SOC 2 preparation is the long-term goal, undertaken when the customer base justifies it. Until an audit is passed, this page will keep saying: not held, never claimed.
This roadmap is a commitment device, not a marketing asset. Items move forward, or we explain why they didn't.
If you find a security problem, write to [email protected]. We take reports seriously, fix what's real, and credit finders on publication with their permission.