Security and privacy
Measurable controls, described plainly, kept current with what is actually deployed. No marketing adjectives: Avern is not "unhackable", it is layered, audited, and honest about its limits.
Last reviewed 2026-09-18 · full write-up available on request to security@useavern.com
Six layers, each one independent of the others
- Your account
- Password sign-in with authenticator-app two-step verification (TOTP). Two-step is mandatory for organization owners, administrators, and every Avern staff member. Changing your password, resetting it, or removing two-step verification signs out every other device. Registration, sign-in, and recovery are rate limited and bot-protected, and never reveal whether an email is registered.
- Who can do what
- Every sensitive read and every change is authorized on the server for the specific person, organization, and action — deny by default. Hidden buttons, edited pages, or guessed links grant nothing. Avern staff roles cannot be self-assigned and are checked on every request.
- Your organization's data
- Isolation is enforced inside the database itself (row-level security and column-level grants), not only in the application. Another organization sees you only through a deal room both of you joined, and only what you chose to share there.
- Documents
- Files live in private storage under server-generated names. Every upload is type-checked by content, size-limited, hashed, and scanned before it can be shared with a counterparty. Download links expire in 60 seconds and are never written to logs. A share can be revoked at any time and stops working immediately. Every upload, download, share, and revocation is recorded.
- Encryption
- All traffic uses HTTPS with strict transport security. Data at rest is encrypted by our infrastructure providers, and the most sensitive personal identifiers — dates of birth and tax identifiers — are additionally encrypted by Avern with keys that never touch the database or your browser.
- Accountability
- Sign-ins, failed attempts, membership and role changes, verification decisions, document access, staff actions, billing changes, and data requests are written to an append-only audit log that cannot be edited or deleted — by anyone, including Avern. Your organization's owners and compliance members can read their own log inside the app.
Controls in your hands
- Two-step verification
- Enrol an authenticator app from Security. Owners and administrators must.
- Your audit log
- Organization → Audit shows every security-relevant event for your organization.
- Sharing, revocable
- Documents shared in a deal room can be withdrawn; access ends at once.
- Export or delete
- Organization → Your data lets an owner request a full export or deletion. A person, not a script, carries it out and records the outcome.
- Session control
- A password change signs out all other devices.
- Support with a paper trail
- Requests, replies, and attachments live inside the app, not in email threads.
How Avern staff work
Verification is done by people, and "under review" means exactly that. Staff see only what their role needs — a support agent cannot moderate deals; a finance role cannot review verification — and every staff action is attributed to a named person and visible in the audit log. Founder and developer testing uses clearly labelled simulated data that is walled off from real organizations.
What we do not claim
- Verification states reflect what Avern reviewed at a point in time. They are not a guarantee of a counterparty's conduct or solvency.
- Avern never asks for your password, two-step codes, or documents by email. Anything that does is not from us — forward it to security@useavern.com.
- Some capabilities are gated until their controls are in place. For example, sharing documents with counterparties requires our malware scanning to be fully enabled, and we say so in the app rather than pretend otherwise.
Privacy
We collect what verification and trade require, keep it for defined periods, and publish the retention table. Personal-data questions and rights requests: privacy@useavern.com. Legal notices: legal@useavern.com.
Responsible disclosure
If you believe you have found a security issue, email security@useavern.com. Please do not test against other customers' data. A formal disclosure policy will be published before general availability.