Public-company status and security.

Public-company status

Ticker	OTC: EVIO
State of incorporation	Colorado
Headquarters	Henderson, Nevada
Reporting status	OTC Current (not an SEC registrant)
Disclosure cadence	Per OTC Markets disclosure requirements (OTC Current); annual + quarterly reports + audited financials
Audit-log retention	Indefinite for compliance: per-agent action history exportable on request

Application security

Transport	TLS 1.2+ everywhere via Cloudflare; HSTS enabled
API keys	SHA-256 hashed at rest; plaintext shown once at creation
Per-agent scoping	Recommended over org-wide keys; pause/revoke with 1-second propagation
Rate limits	Per-agent rate limits, configurable
Webhook signatures	HMAC-SHA256 on all outbound; Stripe + Clerk inbound verified before any DB write
Two-factor auth	Required for org owners; recommended for all users
Audit log	Every admin action logged with actor (user OR agent), target, metadata
Secrets management	Doppler: never in code, never in git
PII storage	Email + name (Clerk) + Stripe customer ID. No SSNs, no payment-card data on EVIO infra.

SLA targets

EVIO does not publish a contractual SLA. Internal targets:

Metric	Internal target
Uptime	99.9%
p50 latency (mock data)	< 200 ms
p95 latency (mock data)	< 800 ms
Webhook delivery (first attempt)	< 30 s
Status page	status.evioinc.com

Subprocessors

EVIO uses the following subprocessors. Full list maintained at /api/legal/privacy.

Auth & org management	Clerk
Billing	Stripe
Database	Supabase (Postgres)
Edge / WAF / CDN	Cloudflare
Cache & rate limit	Upstash Redis & QStash
Behavioral warehouse	MotherDuck
Logs & metrics	Better Stack
Errors	Sentry
Secrets	Doppler
Hosting	Vercel (web), Fly.io (API)
Documentation	Mintlify