Drover Intelligence Inc.

Security

Effective date: 25 October 2026

Drover's safeguards are designed to protect commercially sensitive information used by businesses and their advisors. This statement describes our approach. Commitments in a signed service or data-processing agreement also apply.

We design our architecture and operational controls around SOC 2 security and confidentiality principles—including strict workspace isolation, encrypted transport, least-privilege credentials, and change logging—as we work toward formal SOC 2 readiness. Drover has not yet completed a SOC 2 audit.

Access and organization boundaries

We restrict access by permissions and operational need. Authorization controls associate client information with the appropriate organization and are designed to prevent unrelated workspace access. Advisor permissions determine which firm users can access each client's information. A shared firm workspace is not a separate private workspace for each user.

Personnel access is limited to authorized service, support, administration, security and legal purposes, subject to confidentiality obligations. We review access when responsibilities change.

Information protection

We use encrypted connections for the website, application and supported provider connections. Where uploads are enabled, application and storage permissions restrict file access. Exports can create copies outside Drover's control.

We control service credentials, restrict access to operational records and limit sensitive information in logs. Authentication and anti-abuse measures supplement authorization checks for client information.

AI and service providers

We assess providers and use appropriate contractual and other safeguards. Private client information is processed for the relevant client. It is not used by Drover to train general-purpose AI models, and we require the same restriction from AI providers processing that content for us. Provider retention for agreed processing, security or legal purposes is distinct from training.

A provider's certification or assurance report does not establish equivalent assurance for Drover. Contact us about any assurance materials available for Drover.

Monitoring and response

We investigate suspected misuse and incidents using security and operational records, assess scope, contain and address issues, preserve evidence and make notifications required by law or contract.

Your role

Use individual accounts, protect credentials and devices, review permissions and check recipients. Enable additional authentication where available. Remove unnecessary access and report suspected unauthorized access promptly.

Third-party messaging channels, exports and recipients may retain their own copies. No online service can promise absolute security, uninterrupted availability or immunity from every attack. This does not limit safeguards, remedies or duties that applicable law requires.

Report a security concern

Email hello@droverintelligence.com with “Security” in the subject line, describing the issue, time and affected feature. Do not send passwords, tokens or unnecessary personal information. Request secure transfer for sensitive evidence. Testing another person's data or disrupting the service requires written authorization.