Approval-first architecture
Aurva never performs a consequential external action — refund, subscription change, ticket reply, workflow update — without a human approval. Every recommendation names the risk, the action, the systems it will touch, and the expected outcome. You can approve, modify, or reject.
Data isolation
Every record in Aurva is scoped to a workspace (“org_id”) and enforced at the query layer. Cross-tenant access is technically impossible through the product. Employees do not have production data access by default; requests are ticketed and time-boxed.
Sub-processors
Aurva relies on a small set of vetted sub-processors — Stripe (payments), managed cloud hosting, transactional email, error monitoring, and AI providers we use to power our workers. A current list is available on request from aurva.operations@gmail.com.
Credentials + secrets
Integration credentials are stored server-side, encrypted, and never exposed to your browser. Only a masked hint is displayed in the UI. Rotating a credential in the source system automatically re-validates the integration on the next sync.
Reporting a vulnerability
If you believe you have found a security vulnerability in Aurva please email aurva.operations@gmail.com with subject prefix SECURITY:. We aim to acknowledge within one business day and remediate valid reports as quickly as possible.
Incident response
Aurva maintains a written incident-response policy covering detection, containment, eradication, recovery, and customer notification (72 hours for confirmed personal-data breaches). Every P0 / P1 incident is followed by a blameless post-mortem with root cause and concrete follow-ups. A summary of the policy is available on request from aurva.operations@gmail.com.
Authentication + password controls
Passwords are hashed with bcrypt. New accounts require a minimum of 12 characters with mixed case, digit, and symbol. Failed-login brute-force protection locks an account for 15 minutes after 5 consecutive failures. Session cookies are HTTP-only, Secure, and SameSite=None; JWTs expire in 12 hours. Google Sign-In is available for password-less access.
Environment separation
Aurva's production database, integration credentials, and Stripe keys are strictly separated from development and test environments. Test-mode Stripe keys and preview URLs never touch production data. New engineers work only against seeded, synthetic datasets.
Compliance
Aurva is architected against SOC 2, GDPR, and CCPA principles. Formal reports are made available under NDA to Enterprise customers. Contact aurva.operations@gmail.com for the current status of our compliance program.