Security
Measurable controls, described plainly. No marketing adjectives.
- Accounts
- Password sign-in with authenticator-app two-step verification (TOTP). Two-step verification is required for organization owners, administrators, and all Avern staff. Registration, sign-in, and recovery are rate limited and bot-protected.
- Authorization
- Every sensitive operation is authorized on the server for the specific person, organization, and action. Client-side state, hidden buttons, and URL guessing grant nothing.
- Organization isolation
- Your organization's data is scoped at the database level with row-level security, in addition to application checks. Cross-organization access exists only inside a deal room both parties joined.
- Documents
- Sensitive documents live in private storage. Access requires authorization, links are short-lived, files are hashed on upload, and every access is recorded.
- Audit trail
- Security events, membership and role changes, verification decisions, document access, and administrative actions are written to an append-only audit log.
- Staff access
- Avern staff roles are separate from customer roles, cannot be self-assigned, require two-step verification, and are attributable to a named person.
- Transport and headers
- HTTPS everywhere with HSTS, a content security policy, and frame embedding disabled.
- Vendors
- Identity verification, sanctions data, email, and payments use established providers behind replaceable interfaces. Avern does not store card numbers or build its own biometric checks.
Responsible disclosure
If you believe you have found a security issue, email security@useavern.com. Please do not test against other customers' data. A formal disclosure policy will be published before general availability.