Infrastructure and hosting

• Built on the Microsoft Azure cloud platform, using data centers only within the United States
• Production backups are encrypted and stored in a separate U.S. region
• Network segmentation separates internet-facing services from internal components
• Continuous security posture monitoring with Microsoft Defender for Cloud

Data protection

• Encryption at rest (AES-256) with keys managed in Azure Key Vault
• Encryption in transit (TLS 1.2 or higher) for all web and API traffic
• Sensitive data discovery and classification with Microsoft Purview
• Data loss prevention controls on outbound traffic
• We collect and use only the data described in our Privacy Policy

Identity and access

• Single sign-on and multi-factor authentication through Microsoft Entra ID
• Least-privilege, role-based access; production access is approval-based and limited
• Access reviews at least annually, with access removed within 24 hours when no longer needed
• Administrators accept our Terms of Use when their credentials are created, and again whenever the terms change

Secure development

• A documented secure software development lifecycle with code review and automated testing
• Staged releases through test and staging environments before production
• Production data is not used for testing; test environments use synthetic, masked, or de-identified data
• Application code is scanned for vulnerabilities before deployment

Testing and monitoring

• Independent third-party penetration testing, most recently completed in August 2026
• Ongoing vulnerability management and scanning of internet-facing systems
• Centralized logging, auditing, and anomaly detection

People and training

• Background checks for eligible personnel
• Security and privacy training at onboarding and annually, with phishing awareness exercises
• Confidentiality obligations and annual policy acknowledgment for all workforce members

Incident response

• A documented incident response plan with defined roles, escalation, and notification procedures
• We practice “what if” scenarios through tabletop exercises
• If an incident affects your information, we notify you and our partners as required by law and contract

Business continuity

• A business continuity and disaster recovery plan for the Vivery platform
• Automated, encrypted backups with restore testing under our backup policy
• Redundant Azure infrastructure designed for resilience

Protecting health information

When Vivery is provided through a health plan, healthcare provider, or other HIPAA-covered organization, ABIT acts as that organization’s business associate. We protect health information as HIPAA and our business associate agreements require. Every vendor that handles protected health information on our behalf does so under its own business associate agreement.

Your information, your rights

• We do not sell personal information or share it for targeted advertising
• We keep information only as long as needed, and we delete closed-account data after 90 days unless the law or our contracts require us to keep it longer
• You can request access to, correction of, or deletion of your information
• Every Vivery page links to our Privacy Policy

What AI does in Vivery

• Program recommendations: our in-house models suggest programs that may fit a person’s needs, location, and schedule
• Reminders and check-ins: an AI service helps time and word short in-app messages, using templates written by program staff
• Translation: machine translation helps people use Vivery in their preferred language

Our safeguards

• No personal information or PHI is sent to third-party AI models; they receive only the minimum, non-identifying data needed
• The third-party AI services used in production run in Microsoft Azure in the United States, under contracts that prohibit using our data to train their models
• Recommendations are suggestions only. AI never decides eligibility or denies services.
• Data provided by our health plan partners is not used to train AI without their written authorization
• People can turn off personalized recommendations at any time