Certified, not claimed.
You're trusting Hevi with commercially sensitive contracts. We hold ourselves to the standard your IT security team wishes every vendor met — independently audited and continuously monitored.
ISO/IEC 27001:2022
CERTIFIEDThe leading international standard for information security management. Hevi operates a certified ISMS with annual independent surveillance audits.
SOC 2 Type II
CURRENTIndependent attestation covering Security, Availability and Confidentiality — Type II, meaning controls are tested as operating over time, not just described on paper.
Penetration testing
ANNUALAn independent security firm attempts to break into Hevi every year, with findings remediated and verified. Summary available under NDA.
Continuous monitoring
ALWAYS ONCompliance controls monitored continuously — not dusted off before the annual audit. Vulnerability scanning runs every 24 hours, and Microsoft Defender provides real-time threat detection.
No model training on your data. Full stop.
Hevi uses stateless, pre-trained models inside our own onshore Azure environment. Your documents and prompts are never used to train or fine-tune AI models, and no model retains your commercial information.
No model training
Your prompts and documents are never used to train or fine-tune models. Full stop.
Content filtering
Input validation, platform filters, and prompt shields block jailbreaks and injection attempts.
Permission inheritance
The AI can only read or draft what the current user is allowed to see.
Stateless inference
Document text is retrieved at inference time only and is not retained by the model.
Your data never leaves. By design, not by policy.
Everything — storage, backups, document processing, and the AI itself — runs inside Hevi's own onshore Microsoft Azure environment. Nothing is sent to external AI APIs. Nothing is processed offshore.
Ingest
Authentication · Role-Based Access Controls · Minimum TLS 1.2 encryption in transit
Store
Onshore data storage · AES-256 encryption at rest
Retrieve
Retrieval Augmented Generation · AI inherits user's permissions
Cited answer
Zero hallucination · All responses include links to the exact source page
Stateless AI models: the model sees extracted document text at inference time only. It does not learn from it, retain it, or expose it to anyone else. Your data is never used to train or fine-tune AI models.
What your IT security team will ask. Answered.
Single Sign-On, standard
Authentication with SSO available through Microsoft 365 or Okta. SSO can be enforced for your company's domains.
RBAC
Role-based access at contract level — users see only the projects and documents they're authorised for.
Data residency
All storage, backups and AI processing run onshore in Microsoft Azure. Nothing stored or processed internationally.
Encrypted everywhere
Data is AES-256 encrypted at rest. Hevi enforces minimum TLS 1.2 encryption for data in transit. Backups are encrypted and immutable.
No AI model training on your data
Full stop — no training, no fine-tuning, no retention of your documents in any model weights.
Your data, deletable
You maintain ownership of your data and can permanently delete it at any time.
Human in the loop. Your people decide.
Hevi's AI provides information and suggestions but it never takes actions without a deliberate user click. The AI surfaces and drafts — your commercial team judges and decides. For example, Hevi may identify a potential claim, but it cannot submit it without a human action.
Human-centred design
Hevi balances ease of use with human control. AI will show intuitive buttons for actions it suggests, but cannot take those actions on its own.
Editable output
Hevi allows you to download outputs in Word and Excel formats so you can continue to edit drafts outside the platform.
More than just AI
Hevi is a fully-featured contract administration platform with claim registers, site diaries and more - it is not just an AI chatbot.
The paperwork your procurement team wants? Ready to go.
Send us your security questionnaire.
CAIQ, SIG, vendor risk review, or your own format — we complete assessments for Tier 1 contractors and mine owners and turn them around fast.