TolavoTrust
What you can rely on, and what not yet.
How Tolavo controls access and handles data, who is responsible for what, and which independent checks have not happened yet.
At a glance
Access controls
In place
Your records are scoped to your workspace; only Tolavo’s operator area reads across workspaces. Two-factor sign-in is available but not forced.
Data handling
In place
Credentials are encrypted or refused. Run contents are not kept by default. You can export your workspace.
Hosting
Declared
Your AI runs where you host it. Tolavo’s own providers are listed under sub-processors.
Responsibility
Shared
You run your AI and support your clients. Your clients pay you directly.
Support
Available
Signed-in customers raise requests with a reference. Anyone locked out can ask a person.
Independent assurance
None yet
No SOC 2 report, ISO 27001 certificate, external penetration test or independent review yet.
Show what your AI can and cannot do.
Your client does not open the passport. The proposal carries its access and limit lines.
Declared by Example Studio
- Can access
- One invoice mailbox, read only
- Cannot do
- Approve, send or change a payment
- Human approval
- A person approves every payment request.
Tolavo records this setting. It does not enforce it.
Recorded by Tolavo
- Status
- Published Registered in Tolavo.
- Security
- Worked out on every read from the credentials Tolavo stores.
Independent review
- None yet
- No outside party has checked this system.
- Declared
- Written by you, kept with who wrote it and when. Tolavo does not check it.
- Recorded
- Worked out by Tolavo: whether it is published, and the security line.
- Independent
- Nothing yet. No outside party reviews passports today.
What the status words mean.
- Published
- Registered and published in Tolavo, ready to offer. It says nothing about whether a call works.
- Not tested
- No test call has been made yet.
- Test passed
- The last test call answered.
- Test failed
- The last test call did not answer properly.
- Active
- Set up and accepting production runs.
- Operational
- Active, with recent production runs that succeeded.
The detail behind it.
How this works: who can change a passport
- You cannot write the security line or any rating; each change you make is kept with who made it and when.
- What Tolavo records is assigned by Tolavo, cannot be written by a provider, and is not for sale.
- Publishing writes your human-approval setting into the passport in Tolavo’s words; Tolavo does not enforce it on a run.
- Runs are recorded on the system’s own page, not on its passport, and a finished run’s facts cannot be rewritten: only its outcome and whether a person stepped in can be marked afterwards, and its stored input and output can only be cleared.
How this works: the security line
- It is recomputed on every read from the credentials Tolavo actually stores.
- A stored claim of encryption at rest that Tolavo can no longer back is left out, even from a proposal whose terms are otherwise frozen.
- In a proposal, the line on stored credentials is always shown and describes the credentials that exist when it is read; every other security line can only be withdrawn, never added.
How this works: what Tolavo adds to a passport
- Two things: that the system is published, and the security line. Nothing grades or raises a passport.
- Published means registered and published in Tolavo; it is not a security certification and not an independent review.
- Tolavo holds no SOC 2 or ISO 27001 certificate, and no external audit or penetration test has been carried out.