GeoVivé Docs
Trust & SecurityPrinciples
- Neutral canvas. GeoVivé shows what connected businesses bring; it keeps no subject-matter layers of its own and never resells yours.
- Nothing unreviewed goes live. Every new or changed layer is checked before users see it.
- Least data, least access. Each part of the system can reach only what it needs, and sensitive values are kept out of logs.
Your data stays yours
- Layers are shown only to your users, only inside GeoVivé, and are never listed for other apps, offered for download or used to train models.
- Relay layers are kept as a simplified display copy for no more than 7 days; direct layers are never copied.
- Cached copies are deleted within 7 days of a connection ending. Details are in the AppConnect terms.
- Maps users make belong to those users. Private maps are visible only to their owner.
- Account linking is always the user's choice. An app sees only maps it created for that user or that the user shared with it (read-only), never their email or GeoVivé account ID, and gets a user ID that's different for every app. Users can remove an app any time in My data, and access stops at once.
How layers are reviewed
- Domain proof. Only the business that controls a domain can connect layers from it.
- Automatic checks on every new or changed layer: public HTTPS sources only (private networks are blocked), valid shapes and coordinates, size limits, credits and license, browser access for direct layers, and field names and values that look like personal information.
- AI review of the layer's text (see below), when enabled.
- Human review of anything a person must judge, within 5 business days. Reviewers see the real values so they can decide accurately.
- Approved versions only. Users see the last approved version of each layer; an edit never takes a working layer offline.
- Weekly re-checks of every connected app.
AI review
GeoVivé can use a model on Amazon Bedrock to review a layer's settings and a sample of its text values for personal information, offensive or misleading content, data-quality problems and signs of criminal, security or targeting risk. Controls:
- Only text is sent: layer settings and up to 40 features' labels and shown values, each cut to 300 characters. Shapes are never sent.
- Processing stays in US AWS regions, in GeoVivé's own AWS account. AWS does not use Bedrock inputs to train models, and Bedrock request logging is turned off, so prompts and answers aren't stored.
- The model is instructed to treat your data as untrusted and never follow instructions inside it.
- AI findings never reject a layer on their own: they either add a note for you or send the layer to a person.
- Only one model is permitted, reviews are capped per day, and AI review can be switched off at any time.
Findings and notices
GeoVivé tells you what it detects; fixing it stays in your systems.
| Finding | What happens | When you're told |
|---|---|---|
| Personal information | Layer held for review | Immediately |
| Offensive content | Layer held for review | Immediately |
| Misleading content | Held for review if serious | Weekly digest |
| Data quality | Layer shows; please fix | Weekly digest |
| Credits and licensing | Layer shows; please fix | Weekly digest |
| Possible criminal activity, security threats or targeting of people | Layer held; evidence preserved; may be escalated | Told only that the layer is held for review |
Each finding is reported once. Findings in the last row stay with GeoVivé because they may need legal escalation to protect users and the platform; see section 7 of the terms.
Logs and retention
- Service logs are scrubbed before they're written: emails, phone numbers, street addresses, sign-in tokens, signed-link signatures and payment secrets are masked, and each entry is size-limited, so layer data and request bodies can't be logged whole. Logs are kept 30 days.
- Check results store only where a problem is (for example “email address in Note”), not the value.
- Layer versions waiting for human review, with a sample of values for the reviewer, are deleted after 90 days.
- Evidence for possible criminal, security or targeting findings is kept encrypted in a separate restricted store for two years. The checking service can add to it but can't delete from it.
- When an app disconnects, its display, relay and review copies are deleted at once; its reports and history are deleted 90 days later.
- Reports and exports are delivered through short-lived signed links (10 minutes for reports).
Who can do what
| Who or what | How it proves itself |
|---|---|
| People | Signed in with GeoVivé accounts (Amazon Cognito; email or Google). App owners see only their own apps. |
| Payment confirmations | Stripe's signature on every message, checked within 5 minutes |
| Linked apps | Their client secret plus the user's consent (OAuth 2.0 with PKCE). Tokens are random, stored only as hashes, last an hour, and stop when the user or GeoVivé ends the link |
| Layer reviewers | Signed links tied to one layer version, expiring in 30 days |
| Scheduled checks and background jobs | AWS roles limited to the exact tables, files, email sender and model they use |
| Your data sources | GeoVivé reads only public HTTPS addresses and sends no credentials |
Everything is served over HTTPS and stored encrypted at rest.
Payments
Payments are handled by Stripe. GeoVivé never sees or stores card details, and holds no Stripe account keys; it only receives Stripe's signed confirmation that a payment completed.
Reporting a problem
If you see a layer that exposes personal information or looks harmful, or you've found a security issue, email admin@geovive.link.