CUVENA / SECURITY ASSURANCE
Our security approach, assessment preparation and public security documentation.
PUBLIC SECURITY INFORMATION
Cuvena is an Arynox product operated by ARTISIANA LIMITED, New Zealand. This page describes the product’s security approach and the scope of our assessment preparation. It is not an audit report or a certification statement.
Our core preparation scope covers SOC 2 Security, Availability and Confidentiality, and ISO/IEC 27001. No completed SOC 2 examination or ISO/IEC 27001 certification is represented here. Independent assessment and operational evidence remain necessary.
Framework names identify preparation objectives. They do not imply endorsement by an auditor, AICPA, ISO or a certification body.
Cuvena separates platform administration, organization membership and execution permissions. Authenticator protection and scoped authorization are part of the product. Customers remain responsible for their users, target systems and the permissions granted to execution accounts.
Login passwords are stored as password hashes. Recoverable application secrets use authenticated encryption. Key custody, rotation, backups and deployment permissions require operational configuration and verification.
Agents connect to Cuvena and execute authorized work against permitted targets. Update packages use signed release metadata. A privileged customer script retains the privileges of the account that runs it; approvals and account permissions must be chosen accordingly.
Product tests, infrastructure verification, recovery exercises and independent assessments provide different kinds of evidence. A passing software test or a hosting provider’s certification does not certify Cuvena.
Privacy obligations and customer-specific regional assessments are reviewed separately. This page does not make a blanket claim of compliance with every jurisdiction or government assurance programme.
Read the public security statement →SUPPORT WITH ACCOUNTABILITY
Cuvena support workspaces let authorised platform staff investigate an organisation without asking for a customer's password or replacing their login.
Standard access requires customer approval by default and starts read-only. Platform owners and separately authorised privileged support staff can investigate without an individual customer approval. Platform owners are not required to use an authenticator for support access. Both modes identify the staff member and record activity in the organisation and platform audit logs.
Read how support access worksACCOUNT ACCESS
Platform owners can assign detailed Admin roles to administrators and support staff. Optional authenticator setup includes a scannable QR code and single-use recovery codes. Enabled authenticator protection is enforced at sign-in.
Read the access and recovery guideCUVENA SCRIPT MANAGER
