How your data is protected

Revo holds sensitive information about your customers' infrastructure. This page describes the controls that protect it. Revo is in private alpha; it holds no compliance certifications.

Tenant isolation

Every MSP workspace's data is separated twice:

1. In the application: every query is scoped to your workspace, and customer-portal users are additionally pinned to their one customer.
2. In the database: every workspace table uses forced PostgreSQL row-level security, and the application connects as a role that can't bypass it. A query that forgot its filter still only sees your workspace's rows.

Two MSPs that both manage the same organisation never share connections, tokens or data.

Encryption

• At rest: sensitive data is encrypted with AES-256-GCM. That includes MFA secrets, integration credentials (PSA, ThreatLocker, GitHub, your Microsoft 365 and GitHub apps), webhook secrets, installer-link tokens, finding evidence, check details, agent results, device status details, alert details and change history.
• Integration secrets are write-only: once saved, API keys and client secrets for integrations are never shown again; only a short hint (such as the last four characters of a client ID) is displayed.
• Credentials you keep in the vault can be revealed. A person needs the permission, a reason and a two-factor check in the last 15 minutes; an API token needs the core.vault.reveal scope. Every reveal is audited. See Credentials.
• Passwords are hashed with Argon2id. API keys and session tokens are stored as hashes.
• In transit: the web app, the API and the agent use HTTPS. The agent validates certificates and never falls back to an insecure connection.

The agent

• Every job the agent runs is signed by your Revo server, bound to that device, customer and workspace, and valid for a limited time. The agent verifies the signature against a key it pinned when it enrolled.
• The agent runs only the job types that both the customer's modules and the device's own policy allow.
• A script runs only in a version one of your approvers signed with a passkey, and the agent checks that signature itself. See Scripts. Patch installs only use the device's own update sources.
• Agent releases are signed with Revo's offline release key; the agent checks the signature before replacing itself.
• The agent collects no credentials. Its regular reports aggregate event data and leave out free-text log messages, command lines and passwords. Background tools read event logs, files and the registry only when a technician asks, and their answers are dropped after an hour.
• The device's local administrator can switch off patching, restarts, remote uninstall and Windows upgrades. See Local controls.

Microsoft 365 and other integrations

• Microsoft 365 access goes through your workspace's own Entra app, approved by each customer's administrator. It's read-only unless you turn on RevoCloud's management access, which each customer's administrator consents to again. No customer passwords are stored, and the customer can revoke access at any time. See Connect Microsoft 365.
• ThreatLocker access is read-only through a dedicated view-only API user. See Connect ThreatLocker.
• Outbound connections Revo makes for you (scans, webhooks, integrations) are checked so they can't be pointed at private or internal addresses.

Scanning only what you're authorized to test

Passive external assessments use public information only. Active scans need a verified domain, a written attestation and an administrator's approval. See Scope and authorization.

Customer confidentiality

Turning Show to customer off on a finding is a full boundary: customer-portal users and client reports see no trace of it, not in scores, totals, charts, history, plans or evidence. Related findings on the same host are hidden with it. See Customer portal.

The AI analyst

The AI analyst reads your data with your permissions, can only run live checks against the customer's own registered domains, and can't change anything without a person's approval. Data from scanned systems is treated as untrusted and checked for prompt-injection attempts. See What the AI can see.

Support access

Revo staff always see account details needed to run the service (users, plan, usage, job status). They see your customer data (your customers, and with RevoSecure their assessments and findings) only while you allow it:

• An owner or admin grants access in Settings → Support access, with a reason and a duration (4 hours to 7 days), or approves a request from support.
• Access is read-only, time-limited and revocable at any time.
• Every grant, and every view staff make while it's active, is recorded in your audit log.

The audit log

An append-only record of sign-ins, permission changes, approvals, AI actions, report downloads, integration changes and support views. See Audit log.