Strovia: Governed data exchange for pensions & finance. Secure, connect, transform, deliver.

Security at Strovia

Pension data deserves care. This is how we approach it.

  • Your data stays in the EU. Customer environments are hosted in EU data centres.
  • Minimal data. VB-PUO messages carry scheme- and cohort-level figures, not data about individual members.
  • Encryption in transit (TLS, mutual TLS for the SIVI API) and at rest.
  • Connections you control: the connector agent in your network only connects outwards, so no inbound firewall ports are opened. Credentials are kept in a secure vault and never shown, and every change to a connection needs a second person’s approval.
  • Access control: single sign-on with your own identity provider, role-based permissions and maker-checker for every production change. Two-step login is required: your organisation confirms that your sign-in provider asks everyone for a second step before anyone can sign in.
  • Separated environments: test and production are kept apart, and test messages are marked and blocked from live counterparties.
  • Audit trail: every action is recorded with who, what, when and the exact versions involved.

What happens to a file you try on this website

The demos on this website run on a separate demo server with no customer data, so that our checks stay ours. You can try every demo with our synthetic samples; if you use your own file:

  1. It is sent encrypted (HTTPS) to Strovia’s demo server in the EU.
  2. It is checked in memory and never written to disk.
  3. Its contents are never stored or logged. The server records only that a check ran, how long it took and its outcome.
  4. Only the result comes back to your browser; the file is gone from the server when the check ends.

Prefer not to upload anything? Use our samples, or book a session and we run your message through the checks together.

Our roadmap for regulated customers [FOUNDER TO CONFIRM TIMING]: annual independent penetration testing, a DORA contract annex, an exit plan and escrow option, and work towards ISO 27001 or ISAE 3402 / SOC 2.

Questions from your security team are welcome. Contact us