Security

This page summarizes how Morevy protects your account and your data. The controls behind it, and the policy documents, are on the Morevy Trust Center.

Signing in

You sign in with Continue with Google or Continue with Apple. Morevy does not store a password for you, so your account is protected by your Google or Apple sign-in, including any two-step verification you have turned on there.

Where your data is stored

Your data is stored and processed in Google Cloud in the United States, and encrypted in transit and at rest. Each workspace's data is kept separate from every other workspace.

Access to your billing system

Stripe access is read-only. Morevy cannot move money, issue refunds or change anything in your account, and the connection is stored encrypted. Every other system comes in as a file you export, with no credential at all. See Connecting Stripe.

The AI model

Customer names and other labels in your data are replaced with tokens before anything is sent to the AI model, and restored only when the answer reaches your screen. If the replacement cannot be applied, the request fails. See Data handling and privacy for what the model sees and the full list of services that process your data.

Our controls

• Production data is not used in development or testing, except when needed to debug a customer issue.

• Access to production systems is restricted to named staff, with unique accounts and a second form of authentication.

• Access is removed when someone leaves or no longer needs it.

• Support tools show account details, not your figures.

• Controls are monitored continuously through Secureframe.

Compliance

Our SOC 2 Type I audit is in progress, and the SOC 2 Type II report is expected in the first quarter of 2027. Policy documents can be requested through the Trust Center.

Reporting a security issue

Email hello@morevy.ai with what you found. Please do not include customer data in the email.