# Enterprise Governance & Security > See how Revomo protects commercial data, governs pricing and AI decisions, controls access and approvals, preserves audit lineage, and integrates securely across enterprise systems. Source: https://revomo.ai/enterprise/ --- Enterprise governance & security ## Built for governed commercial decisions at enterprise scale. Protect sensitive commercial data, control who can see and change it, govern pricing and AI actions, and keep a record from recommendation through to the measured outcome. [See Revomo in action](https://revomo.ai/contact/?source=enterprise)[Visit Trust Center](https://revomo-471.trust.site/) - SOC 2 Type II - AES-256 at rest, TLS 1.2+ in transit - Role-based access, least privilege - Approvals and history on the record - 99.9% availability commitment - AWS, multi-availability-zone Security & control ### Protect the data. Control access. Govern the decision. Pricing, cost, customer, contract, rebate and margin data is among the most commercially sensitive a manufacturer or distributor holds. Revomo applies enterprise controls from source access through to the commercial action itself. 01 #### Protect the data Price, cost, customer, contract and rebate records are among the most commercially sensitive data a manufacturer or distributor holds. They are handled as such. - Encrypted in transit with TLS 1.2 or higher, and at rest with AES-256 or equivalent - Keys held in a dedicated key management service with restricted access - Production runs on AWS across multiple availability zones, segmented from non-production - Annual third-party penetration testing, with static and dependency scanning in the build pipeline 02 #### Control access Access follows the shape of the business. An organization is its own tenant of record; workspaces divide the commercial data inside it; roles are granted per resource, not in bulk. - Organizations hold their own data; workspaces partition it by business unit, region or team - Role grants are per resource, so price lists, pricing models, datasets and views are granted separately - Role-based access enforcing least privilege, with unique user identifiers and no shared credentials - Multi-factor authentication on administrative access to production, with quarterly access reviews 03 #### Govern the decision This is where Revomo goes past access control. The commercial decision itself carries rules, thresholds, approvals and an effective date, and none of it is advisory. - Rulesets hold floors, corridors and eligibility as decision tables the business owns - Approval routing by deal size, region or threshold, with exceptions routed rather than absorbed - Effective dating on prices, agreements and programs, so a change has a date as well as a value - Row-level history and a dependency graph across every entity that feeds a decision Governance & control ### Commercial authority should be explicit. Define who can see, recommend, approve, override, publish and measure every consequential commercial action, then let the platform hold the line rather than a policy document. - #### Identity & access Who can reach what. Organization and workspace scope - Per-resource role grants - Least privilege by default - #### Commercial policy What the business allows. Floors, corridors and caps - Eligibility and segment rules - Effective dates on every change - #### Approvals & exceptions Who may authorise a change. Thresholds by value and scope - Routed exceptions, on the record - Publication held until approved - #### History & lineage What happened, and what it rests on. Row-level change history - Dependency graph across entities - Traceable from figure to source record Decision lineage ### Know what changed, why it changed, and what happened next. Every recommendation and commercial action stays connected to the context, rules, approvals and source records that produced it, so a number in a review can be walked back to the row it came from. Conceptual specimen. It shows how the platform’s own records connect: row-level history, the dependency graph across entities, approvals recorded against the objects they affect, and effective dates on every change. AI & agent governance ### AI can reason. Authority remains governed. Revomo AI and agents operate inside the same commercial context, permissions, policies and approval framework as every other capability. Reasoning does not confer authority. - #### Context-bound Agents reason over the same governed commercial context as everything else, not a private copy of it. - #### Permission-aware An agent reaches what the acting scope reaches. It does not widen access to do its work. - #### Human-governed Material actions route for approval on the same thresholds a person would face. Reasoning does not confer authority. - #### Traceable The recommendation, the records it read and the action that followed stay connected after the fact. [How agents operate →](https://revomo.ai/ai-agents-automations/)[Revomo Copilot →](https://revomo.ai/copilot/) Commercial data governance ### One commercial context. Traceable to the source. Customers, products, transactions, prices, costs and agreements resolve into one governed context with consistent definitions, effective dating and the relationships between them, reused by every application rather than rebuilt per report. [Commercial Context →](https://revomo.ai/commercial-context/)[The platform →](https://revomo.ai/platform/) Operating governance ### Scale across teams without losing control. An organization holds its own commercial data. Workspaces partition it by business unit, region or team, and roles are granted per resource, so one team’s work does not reach another’s by default. Answers the question a large enterprise actually asks: can several business units run in parallel without one of them affecting another? Controlled execution ### Control does not stop at the recommendation. The same rules, thresholds and approvals reach the four places a commercial decision actually lands. - #### Price Management List and customer-specific pricing, governed to publication. Rulesets and floors - Approval before publish - Effective dating [See Price Management →](https://revomo.ai/product/price-management/) - #### Quoting & Deal Pricing Guidance on the quote, with authority attached. Target, floor and stretch - Approval thresholds - Exceptions on the record [See Quoting & Deal Pricing →](https://revomo.ai/product/quote-management/) - #### Contract Pricing Entitlements resolved from the agreement that governs them. Precedence and entitlement - Effective dates and expiry - Renewal economics [See Contract Pricing →](https://revomo.ai/product/contract-management/) - #### Rebates & Incentives Programs, tiers and accruals under the same controls. Tier and eligibility rules - Accrual logic - Claims reconciled to the record [See Rebates & Incentives →](https://revomo.ai/product/incentives-management/) Enterprise connectivity ### Keep the systems that already run your business. Revomo adds a governed commercial decision and execution layer across your existing environment rather than asking you to replace a system of record. Systems are reached through scheduled file exchange, direct API integration and connections to warehouse and lakehouse sources, managed in the Revomo cloud. Ask about a specific system and we will tell you which pattern applies. - **ERP and order management Transactions, costs, items, customers and agreements. ** *SAP**Oracle NetSuite**Microsoft Dynamics 365**Infor**Epicor**Sage* - **CRM and quoting Opportunities, accounts and quotes kept in step with pricing. ** *Salesforce**Microsoft Dynamics 365**HubSpot**existing CPQ* - **Data platforms Warehouse and lakehouse sources read into the commercial model. ** *Snowflake**Databricks**Google BigQuery**Amazon Redshift**Microsoft SQL Server* - **Files and APIs Scheduled files and direct calls where a platform has no source. ** *SFTP and structured files**REST API**Spreadsheet import* - **External context The outside variables a price should answer to. ** *Indices and commodity series**Currency and surcharge tables**Approved market sources* Trust & compliance ### Independent assurance. Transparent documentation. What your security and procurement teams will ask for, published rather than promised. - #### Assurance Independent attestation of the security program. SOC 2 Type II covering Security, Availability and Confidentiality - A current report on request, once per calendar year, under confidentiality - Annual third-party penetration testing - #### Privacy How personal and commercial data is handled. [Data Processing Addendum with EU Standard Contractual Clauses and the UK Addendum](https://revomo.ai/commercial-transparency/) - Subprocessor list, with role and location for each - Return or deletion of personal data within 30 days of termination - #### Security review What your reviewers will ask for. [Trust Center with the current posture and documentation](https://revomo-471.trust.site/) - [Service Level Agreement and Subscription Agreement published in full](https://revomo.ai/commercial-transparency/) - Questionnaire and architecture support during review [Visit Revomo Trust Center →](https://revomo-471.trust.site/)[Read the agreements →](https://revomo.ai/commercial-transparency/) Reliability & operations ### Built to operate as enterprise infrastructure. - #### Availability The Service is committed to monthly availability of at least 99.9%, measured against total minutes in the calendar month. SLA §2 - #### Monitoring Availability is measured by Revomo’s own monitoring of production systems, and incidents carry a cause, a resolution and the preventative measures taken. SLA - #### Resilience Production runs across multiple AWS availability zones, with production isolated from development and staging environments. DPA Annex II - #### Vulnerability management Static analysis and dependency scanning run in the build pipeline; annual third-party penetration test findings are remediated on risk. DPA Annex II Success & support ### Enterprise control without an enterprise implementation project. Standard activation is configuration-led and included with the subscription. Scope, data, workflows and success measures are agreed through the Activation & Success Plan rather than a traditional implementation statement of work. - #### Activation Activation is configuration-led rather than a development project. Scope, data, workflows and success measures are agreed in the Activation & Success Plan. [See the Activation & Success Plan →](https://revomo.ai/commercial-transparency/activation-and-success-plan/) - #### Support Standard Support covers business days, 9:00 to 18:00 US Central, excluding US federal holidays. Priority Support, where purchased, adds 24×7 on-call response for Severity 1. [Read the SLA →](https://revomo.ai/commercial-transparency/) - #### Security review The Trust Center, the DPA and the published agreements are the starting point; we support questionnaires and architecture review alongside them. [Visit the Trust Center →](https://revomo-471.trust.site/) - #### Commercial terms The subscription agreement, the SLA, the DPA and the capacity schedule are all published, not sent on request. [See commercial transparency →](https://revomo.ai/commercial-transparency/) [See pricing →](https://revomo.ai/pricing/) Enterprise questions ### Answers your reviewers can check. How is Revomo hosted? As a multi-tenant service on Amazon Web Services, in a multi-availability-zone configuration, with production logically segmented from development and staging. The application database is MongoDB Atlas, hosted in AWS. How is our data encrypted? In transit with TLS 1.2 or higher, and at rest with AES-256 or equivalent. Cryptographic keys are held in a dedicated key management service with restricted access. How are roles and permissions managed? An organization holds its own data and workspaces partition it inside that organization. Roles are granted per resource, so access to price lists, pricing models, datasets and views is given separately rather than as one blanket permission. Access follows least privilege, with unique user identifiers and no shared credentials. Does Revomo support enterprise single sign-on? Contact us to review this requirement against your identity provider. We publish only what our current documentation supports, and single sign-on for customer tenants is not among the measures described in our Data Processing Addendum. How are pricing and commercial actions governed? Rulesets hold floors, corridors and eligibility as decision tables the business owns. Approvals route by value, region or threshold, and an exception is routed rather than absorbed. Prices, agreements and programs carry effective dates, so a change has a date as well as a value. Is there audit history and lineage? Datasets can keep row-level change history, and the platform maintains a dependency graph across entities: what a figure depends on, and what would break if it changed. Approvals and price actions are recorded against the objects they affect. How are AI and agent actions controlled? Agents work inside the same commercial context, permissions and approval thresholds as any other capability. An action that would need a person’s approval still needs it when an agent proposes it. AI inference runs through Amazon Bedrock, which is listed as a subprocessor. Is our data used to train AI models? Your data is used to provide, support, secure and improve the Service. Separately, the agreement permits Revomo to use aggregated and de-identified data, including to train and improve models, but only in a form that does not identify and cannot reasonably be used to identify you, your users or your customers. If you need a narrower commitment, raise it during contracting. How does Revomo connect to our ERP, CRM and data platforms? Through scheduled file exchange, direct API integration and connections to warehouse and lakehouse sources, managed in the Revomo cloud. Ask us about a specific system and we will tell you which pattern applies rather than assume one. What happens to our data when we leave? For 30 days after expiry or termination you may request a copy of your data in a commercially reasonable format. After that period it is deleted from active systems in the ordinary course, subject to backup retention schedules and any legal hold. What deployment or data-residency options exist? The Service runs as a multi-tenant application on AWS, and the subprocessors in our DPA are located in the United States. Contact us to review residency or deployment requirements beyond that. Where can our security team find documentation? The Trust Center carries the current posture and documentation. The Subscription Agreement, SLA, DPA and capacity schedule are published in full on this site, and the SOC 2 Type II report is available on request under confidentiality once per calendar year. ### Put commercial intelligence to work without giving up control. See how Revomo connects commercial context, pricing intelligence, AI and governed execution inside the controls your enterprise requires. [See Revomo in action](https://revomo.ai/contact/?source=enterprise)[Visit Trust Center](https://revomo-471.trust.site/)