AVENYQ / TRUST CENTRE
Security at AVENYQ.
The safeguards built into the application, and the boundaries of what we can promise.
Connections and sessions
The application requires an HTTPS application origin in production. Session cookies are configured as Secure, HttpOnly and SameSite=Lax. Deployment certificates, proxy configuration and the production environment still need operational verification. This is not end-to-end encryption.
Account security
Cloud requests validate the signed-in user, confirmed email and enabled beta invitation. Google and GitHub sign-in use the configured authentication service. Protect your sign-in provider account and enable its stronger authentication options where available.
Access controls
The repository includes owner-scoped database and storage policies, account checks and same-origin checks for state-changing requests. Usage counters and request limits help constrain abuse. Their effectiveness depends on correct database migrations and production configuration; they are not a security audit or certification.
Infrastructure and providers
Cloud authentication and workspace storage integrate with Supabase. AI features use a configured external provider. The live hosting provider, regions, staff access procedures, backups and full subprocessor inventory have not yet been verified. No data-residency or certification claim is made.
Data handling principles
Submit only what is needed for your task. Workspace backups and conversation deletion controls are available, with separate controls for memories. Avoid entering passwords, access tokens or unnecessary sensitive information. Application and provider processing should not be treated as a confidential professional relationship.
Responsible disclosure
Report the affected route, a concise description and non-sensitive reproduction steps to the security contact. Redact personal data, credentials and tokens. Do not include other users' content.
Do not access data that is not yours, disrupt the service or run destructive tests. Stop if private data is exposed and report it privately. This page does not authorise intrusive testing, offer a bounty or promise a response deadline. The reporting mailbox must be confirmed as monitored before launch.