Security & trust

Built like it handles money. Because it does.

MAVYN carries a branch's P&L, its client list, and its people's daily work. The rules that protect them are not suggestions in a browser — they are enforced where they cannot be argued with. This page says plainly how.

Access

Enforced at the database, not in the app.

Every seat in MAVYN — owner, sales manager, processor, loan officer, assistant — sees exactly its lane, and the boundary lives at the database row level. A loan officer's session physically cannot read another officer's compensation; branch financials render for the owner and sales-manager seats and nobody else's; confidential leadership notes never enter another seat's view or search. Because the enforcement is in the data layer, a modified browser, an old cached page, or a curious device changes nothing.

Role-scoped everything: pipelines, dashboards, search, and MAVIS's own answers are all filtered by seat before they leave the server.
Server-side write guards: destructive and financial actions — deleting files, marking loans funded, reassigning officers — are verified against the caller's role at the database, not just hidden in the interface.
Fail closed: an unrecognized role gets nothing, rather than someone else's defaults.

Seat viewWhat each seat may see

Rule Owner Sales manager Processor Loan officer Assistant

Loan files All All All Own Added

Branch financials Yes Yes No No No

Another officer’s pay Yes Yes No No No

Leadership notes Yes Yes No No No

MAVIS’s answers Only what the asking seat may see

MAVIS to a borrower A draft. A person sends it.

An unrecognized role Gets nothing. It fails closed.

YesNoAddedthe files an officer adds the assistant to

The AI boundary

MAVIS never freelances with your clients.

MAVIS runs the internal machine autonomously — composing mornings, watching deadlines, alerting staff. But anything that would reach a borrower — a text, an email, a rate update — is generated as a draft and stops there until a human reviews it and taps send. She answers questions using only what the asking seat is permitted to see, and her memory of each person is private to that person's seat. More about how MAVIS works →

Discipline

Proven before it ships. Every time.

Every release of MAVYN must pass a full automated battery — over 3,800+ assertions exercising the real application in a real browser — with zero failures and zero page errors before it reaches production. Not a sample. Every release. When a check and the code disagree, the release waits until the truth is established.

3,800+assertions per release

0failures tolerated

24/7automations on watch

The stack

Enterprise cloud underneath. On purpose.

MAVYN doesn't run on a server in a closet. The data layer is Supabase's managed cloud — a SOC 2 Type II certified platform — running on AWS infrastructure, the same foundation the largest financial institutions build on.

Platform certifications (SOC 2 Type II, ISO 27001) are held by Supabase and AWS respectively — MAVYN inherits the controls by building on certified infrastructure.

Encryption everywhere AES-256 at rest, TLS in transit — every request, every backup.
Postgres row-level security The enforcement layer: seat boundaries are database policy, not application code.
Daily encrypted backups Point-in-time recovery on the platform layer.
Certified foundations SOC 2 Type II at the platform; AWS data centers with ISO 27001, SOC 1/2/3, and PCI-DSS attestations underneath.
No third-party trackers, ever No ad networks, no analytics companies, no tracking cookies. The website counts its own visits through MAVYN's first-party endpoint (which page, how far it was read, which button was pressed) with no IP address stored, and a browser that asks not to be tracked sends nothing.

Your data

Your book stays yours.

Encrypted in transit and at rest Sessions are authenticated per user; the marketing site you're reading makes zero third-party requests.
Exportable in one tap Pipelines, leads, and reports export to the files you already use — your data is never held hostage.
Never used to train anything Your book, your clients, and your numbers are operating data, not a dataset.
Demonstration data in public Everything on this site runs on fictional data — invented officers, borrowers, and numbers. No client or personnel records appear in marketing material.

Found something we should know about? Write to nick@mavynhq.com — reports go straight to the founder.

Enforced at the database, not in the app.

MAVIS never freelances with your clients.

Proven before it ships. Every time.

Enterprise cloud underneath. On purpose.

Your book stays yours.

Run the whole branch on something built to be trusted.