Data Protection.

Last reviewed October 25, 2026. Reviewed at least every twelve months and whenever our practices or providers change.

1. Our principles

• Minimum necessary. We collect and access only the data a task needs, for as long as the task needs it.
• Your systems, your controls. Service work happens inside the systems our clients already run (such as Cortex, ADP, Paycom, Netradyne and scorecards) using accounts the client issues and can revoke at any time.
• Encryption everywhere in transit. Every connection to our website and to the tools we use is encrypted.
• Transparency. We list our providers, we explain our practices in plain language and we answer privacy requests promptly.

2. How this website is protected

• Served through Cloudflare with TLS encryption, HTTP Strict Transport Security and DDoS protection.
• Browser security headers are set on every response: Content-Type sniffing is disabled, the site cannot be framed by other sites, and referrer information is restricted.
• No third-party scripts, analytics, advertising tags or external fonts. Everything the page loads comes from avynt.ai.
• No cookies. There is nothing to consent to and nothing to track you across sites.
• The contact form is handled by a serverless function that validates input, discards automated submissions and forwards the inquiry over encrypted connections.

3. Client data during service delivery

When we provide recruitment, payroll and time card validation or dispatch support, we handle information about our clients' drivers, helpers and staff. For that information we act as a service provider or processor: the client decides what is collected and why, and we act on the client's documented instructions. Our standard working practices are:

• Client-issued, named accounts. Each avynt team member works under an individual account in the client's own systems, with the role the client assigns. Shared logins are not used.
• Least privilege and prompt offboarding. Access is limited to the workflows in scope, and the client is asked to revoke access the same day a team member leaves an engagement.
• No local copies. Driver and payroll records stay in the client's systems. We do not export them to personal devices or unmanaged storage.
• Confidentiality. Every team member is bound by a confidentiality agreement, and a data processing agreement is available to any client who requires one.
• Reporting. Daily and weekly reports share operational metrics, not raw personal records, unless the client asks otherwise.

4. GDPR and UK GDPR

Our clients operate in the United States, so the EU and UK General Data Protection Regulations rarely apply to the data we process for them. We nonetheless align our practices with GDPR principles (lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability), we honor the rights listed in our Privacy Policy for visitors who contact us from the EEA, the UK or Switzerland, and we rely on Standard Contractual Clauses for any transfer of their information to the United States.

5. US state privacy laws

We honor the rights granted by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and by the comparable laws of other states: the right to know, to delete, to correct, to opt out of sale or sharing (we do neither) and not to be discriminated against for exercising those rights. Requests go to [email protected] with the subject line "Privacy request".

6. Compliance status

• GDPR-aligned practices In placePrinciples applied across our work; Standard Contractual Clauses for EEA, UK and Swiss transfers; data processing agreement available on request.
• CCPA / CPRA In placeConsumer rights honored for California residents and residents of other US states with privacy laws. No sale or sharing of personal information.
• Encryption and web security In placeTLS, HSTS and security headers on avynt.ai; encrypted connections to every provider we use.
• Amazon DSP Vendor Exchange Application in progressAmazon's Vendor Exchange is a curated marketplace of service providers for DSPs. Our application has been submitted; we will update this page when Amazon completes its review.
• SOC 2 Not yet auditedWe have not completed a SOC 2 audit and we do not display a SOC 2 badge. When an independent audit is complete, the report will be available to clients under NDA and this page will say so.

7. Subprocessors

The providers that may handle personal information on our behalf for this website and for inquiries:

Clients receive notice before we add a subprocessor that would handle their data.

8. Incident response

If we become aware of a security incident affecting personal information, we contain it, assess the data and people affected, notify the affected client without undue delay (and within the time its agreement requires), support the client's notification obligations and record the cause and the corrective action taken.

9. Report a vulnerability

If you find a security issue on avynt.ai or in one of our applications, email [email protected] with the subject line "Security report", or use the contact details in our security.txt file. Give us a reasonable time to fix the issue before disclosing it publicly, do not access or modify data that is not yours, and do not run denial-of-service tests. We will acknowledge your report within three business days and keep you informed of the fix. We do not pursue legal action against researchers who follow these rules.