How we keep your business data safe
Plain answers about what Averon does today. We only list things that are actually in place. Averon does not hold security certifications of its own (such as SOC 2 or ISO 27001), and we will not claim any until we do.
Encrypted on the way and at rest
Every page and request uses HTTPS. Browsers are told to always use a secure connection. Your data is stored in Cloudflare’s D1 database, which Cloudflare encrypts at rest with AES-256.
Passwords are never stored
We keep only a salted, slow hash of your password (PBKDF2-SHA256, 100,000 rounds), so nobody can read it, including us. After 5 wrong tries the account pauses for 15 minutes, and sign-in attempts are rate-limited.
Connected app keys are encrypted
Keys and tokens for apps you connect are encrypted (AES-256-GCM) before they are saved, and they are never sent back to your browser.
Your company’s data stays yours
Every record belongs to one company, and every database query for company records must be limited to your company before it is allowed to run. We run automated tests that try to read and change one company’s records from another company’s account.
People see only what they should
Owners and admins choose each person’s role. Team members see their own work and their team’s, and only owners can delete the company or export everything.
A record of important changes
Sign-ins, role changes, settings changes, approvals and deletions are written to an audit log. Owners on plans with the audit log can review it in the app.
Card payments go through Stripe
When card billing is switched on, you pay on Stripe’s secure checkout page. Card numbers never reach Averon’s servers. Card billing is not switched on yet.
Backups
The database keeps a point-in-time history, so it can be restored to any minute in the last 7 days, and a full copy can be exported at any time. Owners can download their company’s data any time from Settings.
AI that asks first
The assistant runs on Cloudflare Workers AI. It can only see your own company’s data, and anything that changes your records waits for a person to approve it.
Also in place
- Signed-in sessions use secure, HttpOnly cookies that scripts on the page can’t read. Signing out ends the session on our side too.
- Strict browser protections: a content security policy that blocks injected scripts, plus protection against clickjacking and cross-site requests.
- Shared document links expire on their own, and you can turn one off at any time.
- Deleting your workspace removes your company’s records and signs everyone out.
Not available yet
We’d rather tell you than let you assume.
- Two-step sign-in (a code from your phone) is not available yet.
- Single sign-on (SSO) is not available.
- No independent audit or certification yet.