Security is not a feature. It is the foundation.

Techvica does not issue a SOC 2 Type II report. Instead, our team helps yours map controls, collect evidence, and respond to auditor questions so you can pursue attestation with your CPA firm.

• Shared responsibility matrices for infrastructure vs. your applications
• Pre-filled control narratives you can adapt for your environment
• Office hours with our security team during audit windows
• No substitute for your own signed SOC 2 report

Card data often lives in your compliance boundary even when you process through a platform. We help you document how Techvica fits your PCI scope and coordinate with your Qualified Security Assessor. Your Attestation of Compliance remains yours.

• Architecture diagrams for cardholder data flows involving our APIs
• Written answers for common acquirer and QSA questionnaires
• Guidance on tokenisation and segmentation patterns
• We do not hold a PCI DSS Level 1 AOC on your behalf

FIPS 140-2 validated cryptographic modules protect data at rest and in transit. Keys are managed with hardware-backed HSMs where contracted. Access to production data follows least-privilege and break-glass procedures.

• FIPS 140-2 validated encryption for data at rest
• FIPS-approved algorithms for all data in transit
• Hardware Security Module (HSM) key storage available
• Key rotation and access reviews on a defined schedule
• NIST SP 800-series aligned key management practices
• Detailed encryption appendix available under NDA

Choose where your data lives. We support EU (Frankfurt, Ireland), UK (London), US (Virginia, Oregon), and Australia / New Zealand-aligned regional deployment options. Data does not leave your selected region unless you explicitly authorise it.

• EU, UK, US, Australia, and New Zealand region options
• Contractually enforced data boundary
• Backups remain in-region by default
• Cross-region replication only with written consent
• Transfer mechanisms for GDPR Article 44+ where applicable