How Reachio protects your clients’ accounts and data.

Hosting in the EU

• Reachio’s servers are in the EU (France). Talivio Technology OÜ, the company behind Reachio, is registered in Estonia.
• Some AI model providers reached through the Talivio AI gateway are outside the EU; they are listed with the sub-processors below.
• Transfers outside the EU/EEA rely on adequacy decisions or standard contractual clauses.

Encryption and secrets

• All traffic uses TLS.
• Platform tokens and secrets are encrypted at rest and never sent to the browser.
• API keys are shown once; Reachio keeps only a SHA-256 hash and a 12-character prefix to recognise them.
• Team invitations and client connect links are stored as SHA-256 hashes too; AI assistant connections keep only token identifiers.
• Error messages are scrubbed of secrets, and platform responses are never written to the audit log.

Platform connections

• You or your client sign in on the platform’s own page; Reachio never sees a password.
• Each sign-in is bound to the browser that started it and can be used only once; PKCE is used where the platform supports it.
• Connections are checked every hour: tokens are refreshed, and owners are warned before one expires.
• Disconnecting deletes the token at once and revokes it at the platform where the platform allows it (Google, X).

Access, roles and approvals

• Each agency’s data is kept apart by three separate checks: every screen, every query and every saved record is limited to that agency.
• Six roles: owners and admins manage the team; managers manage brands, connections and approvals; editors make content; client approvers and client viewers see only their own client’s brands.
• Posts, campaign launches and every ad change that raises spend wait for approval; editing after approval voids it.
• API keys and AI assistant connections act as the member who made them, with that member’s role, and can be limited to one brand, given an expiry and revoked.

Audit log

• Every change of state is written to the audit log: who, what and when.
• Ad changes are change sets with their reason, the values before and after, who approved them and a 7-day undo.
• Actions taken through the API or an AI assistant are recorded as such.

AI and your data

• AI features go through the Talivio AI gateway; Reachio holds no AI provider keys of its own.
• Only the content needed for the requested output is sent, without the names or e-mail addresses of your users.
• Customer content and connected account data are not used to train shared AI models, and our AI providers are contractually prohibited from training on it.

Your website visitors

• The tag loader loads nothing third-party before the visitor chooses.
• Visitor events are stored without IP addresses; e-mail and phone only as SHA-256 hashes and only with marketing consent.

Not there yet

• Two-factor sign-in.
• Closing a workspace yourself in the app (write to us instead).
• An independent security certification such as SOC 2 or ISO 27001.

Report a security issue

Found a vulnerability? Write to the address in talivio.com/.well-known/security.txt. Please do not access other customers’ data, degrade the service or publish details before we have fixed it; we reply, keep you updated and credit you if you wish.

security.txt [email protected]

Privacy questions: [email protected].