What we have actually built, what is decided with you at onboarding, and — the part most vendor pages leave out — what we do not hold and will not imply we do.
Each card names the product it is true of. Where the product line is not uniform, the card says so rather than averaging it into a promise.
Isolation is a property of the data model, not a filter bolted on at query time. In Unnatio every record is scoped to its organisation and outlet by construction, and the tenancy layer fails closed rather than open.
Learnatio is multi-tenant across schools, each with its own branding. In Cliniva, a customer's branches share one patient database while stock, duty rosters and cash counters stay scoped per branch.
Nobody gets a screen because they found the URL. Learnatio ships five roles, each with its own dashboard. Unnatio pairs OTP-first login with role-based access from owner through accountant to viewer.
Cliniva scopes the clinic by department, doctor and cash counter, so a front-desk login is not a back-office login.
Unnatio carries an append-only, tamper-evident audit log behind payments, refunds and exports. Cliniva writes immutable invoice snapshots and reconciles each counter close against declared cash, by department and by doctor. Learnatio logs exam activity for anti-cheat review, and Chatori logs every payment retry attempt.
What we will not tell you is that the same depth of audit trail exists everywhere in the line. It does not yet. Ask about the product you are buying and you will get the real answer for that product.
Where a product messages your customers on your behalf, it does so with your own account. Cliniva connects to the Meta WhatsApp Cloud API using the clinic's own credentials, so patient receipts and queue tokens go out from the clinic's number with no per-message middleman sitting in the path.
Unnatio works the same way on the WhatsApp Cloud API, from your business number.
Chatori answers from your own uploaded knowledge base with cited sources, and every AI reply is scored for grounding before it is sent — a reply that scores low is held for a human instead of going out. Its voice AI discloses that it is AI.
Marqeva runs anti-deepfake checks in the talking-photo studio. These are behaviours built into the products, not principles printed on a page.
The site you are reading is statically generated: no runtime database, no visitor accounts, no cookies, no advertising trackers. It is served only over HTTPS with strict transport security and a set of browser security headers on every response.
The only data it collects is what you type into a contact form, and the privacy policy accounts for all of it.
We do not publish a map of regions, because the honest answer depends on the product, the deployment and what your regulator actually requires. A page that promised one answer to schools in Kerala and clinics in Abu Dhabi would be wrong for at least one of them.
Deployment is a conversation. Every point on the right is decided during onboarding and written into your agreement — it is never inferred from this page, and never assumed by us on your behalf.
If data residency is a hard requirement for you, raise it in the first conversation rather than the last. It is a question we expect, and it is answerable in writing for your deployment.
As things stand today
Four Avance holds no ISO 27001 certification, no SOC 2 report and no HIPAA attestation. There is no third-party audit certificate we can send to your compliance desk, and no independent penetration-test report we are able to publish.
We could describe our engineering practices in language that sounds like a certification without ever using the word — most vendor trust pages do. We would rather write this paragraph instead, because the first time a claim on a page fails to survive a compliance review, everything else on that page stops being believed.
If your procurement process requires a certified vendor today, we are not that vendor yet. You should know that before you spend three weeks on an evaluation, not after.
The same rule covers numbers. We publish no uptime percentage and no support response time on this page. Where those are contractual for your deployment they belong in your agreement, with figures we can stand behind.
If you have found a vulnerability in this website or in one of our products, email us with Security in the subject line. Include what you found, how to reproduce it, and the URL or product involved. A short proof of concept helps far more than a scanner report.
We will acknowledge every report that comes from a real person, and we will tell you what we did about it. We deliberately do not publish a response-time commitment here: a number we have not proven we can hold to is worse than no number at all.
We will not pursue legal action over a good-faith report that stays inside the boundaries listed here.
Four Avance is a software company operating from Kerala, India and the UAE. Registration details are published here as they are issued, so a procurement or finance desk can verify them directly with the issuing authority rather than asking us for scans.
What this website collects, the browser-storage keys it uses, who processes what, and your rights under the UAE PDPL and the India DPDP Act 2023.
The terms covering this website, and why access to any Four Avance product is governed by a separate signed agreement instead.
Who is responsible for what when data moves between you, this website and a product deployment. Further down this page.
A plain-language note on who is responsible for what when data moves between you, this website and a Four Avance product. It is an explanation, not an agreement — the agreement is the document we sign with you.
This document is a draft prepared for legal review. It is not yet in force.
Visiting this website and running one of our products are not the same relationship, and the responsibilities are not the same either.
For this website, Four Avance decides what is collected and why, so we are the controller of it — the privacy policy is the full account.
For a product deployment, your organisation decides what data goes in, who may see it and how long it stays. Your organisation is the controller; Four Avance acts on your instructions as a processor, and what we may and may not do with that data is set by your agreement with us, not by our own preferences.
Only what you type into a form or a WhatsApp message: your name, your email address or phone number, the organisation you are with, and what you wrote. That is the entire set. There is no analytics identifier tied to it, no advertising audience built from it, and no enrichment service run against it.
Four categories, no more, and each does one job:
Where a product deployment runs, which sub-processors it involves, how long records are kept, how they are exported and how they are destroyed at the end are all deployment-specific. They are agreed with you during onboarding and written into your agreement.
We are not going to publish a generic answer on this page and let you assume it applies to you. If data residency, sub-processor disclosure, retention periods or a right to audit matter to your organisation, raise them before you sign — those are exactly the questions we expect a serious buyer to ask, and they are answerable, in writing, for your deployment.
Tenant isolation, role-based access and audit logging on sensitive actions are engineering properties of the platforms themselves. The trust page above sets out, product by product, which of them are actually built today — including where the answer is not yet uniform across the product line.
If you are a visitor to this website, send your request to us directly — the privacy policy explains how.
If your data is inside a product because a school, clinic or business put it there, that organisation is the right first stop: it is the controller, and it decides. When it asks us to help retrieve, correct, export or delete a record, we act on that instruction. If you write to us instead, we will not act unilaterally on data that is not ours to decide about — we will tell you who the controller is so you can go to them.
If we become aware of a security incident affecting personal data we hold or process, we will notify the affected controllers, the people affected and the relevant authorities to the extent the law requires, with what we actually know at the time and updates as we learn more. We would rather tell you something incomplete early than something polished late.
This note explains our approach; it does not create obligations on its own and it does not replace a data processing agreement. Where your procurement, compliance or legal team needs a signed DPA, ask us for one at business@fouravance.com and we will work through it with you.