Security & Trust

Below are the controls in place today, what data we collect and what we don’t, and where we are on certification.

TLS 1.3 in transit
In place
Encrypted at rest
D1 + KV
JWT + RBAC
Short-lived tokens
Zero-trust edge
Cloudflare Workers
Audit logging
Every admin action
Minimal data collected
Public signals, plus what you choose to report
Security Practices

Built with security at every layer

Data Encryption

All data encrypted at rest (D1) and in transit (TLS 1.3). API keys stored as hashed secrets.

Access Control

JWT-based authentication with short-lived tokens. Role-based access control for multi-tenant isolation.

Audit Logging

All API access and administrative actions logged. Tamper-resistant audit trail for compliance.

Infrastructure

Edge-native, zero-trust architecture

Edge Compute Workers

Edge-native, no traditional servers to compromise. Zero cold starts, global distribution.

D1 Database

SQLite-based, encrypted at rest, automatic backups.

KV Cache

Encrypted, distributed, automatic TTL-based expiry.

Customer data is processed only by Averrow and the sub-processors listed on our Data Processing Agreement page.
Privacy & compliance

What we can state today

We list concrete facts rather than certifications. SOC 2 is in preparation — we don’t want to overstate where we are.

Available
Data Processing Agreement Available
A DPA is available on request, and our sub-processors are listed in it. What the DPA covers.
Operating today
Data minimised In place
We collect only the data the product needs. Contact us for our privacy documentation.
In preparation
SOC 2 Type I In preparation
SOC 2 Type I: in preparation. Ask us for our current security documentation.
Responsible Disclosure

We welcome security researchers

We believe that working with skilled security researchers is essential to keeping our platform and users safe. If you discover a vulnerability in Averrow, we encourage you to report it responsibly. We are committed to investigating all legitimate reports and resolving issues as quickly as possible.

We provide a safe harbor for good-faith security researchers. We will not pursue legal action against individuals who discover and report vulnerabilities responsibly, provided they make a good-faith effort to avoid privacy violations, data destruction, and service disruption.

Report to
security@averrow.com
Response time
Within 48 hours

Reporting brand abuse rather than a vulnerability? Forward phishing emails or report impersonation, lookalike domains, and counterfeits at averrow.com/report-abuse.

Data Handling

What we collect and what we don't

● What data we collect

  • Domain names
  • Email security records (public DNS)
  • Social platform public profiles
  • Threat feed matches
  • Account information for your users (name, email address, sign-in method)
  • For the Abuse Mailbox: the reporter’s email address, the original sender, the subject, and a short excerpt of each reported message
  • At most, the approximate country of public scan requests (no IP, city, or coordinates stored)

● What we DON'T collect

  • Mailbox access: we never connect to your mail systems, only to messages that are forwarded to us
  • Passwords (sign-in uses Google, magic links or passkeys)
  • Internal network data

● Retention

  • Active account data retained during subscription
  • Scan results cached 24 hours
  • Account deletion within 30 days of request
  • Rate-limit records expire within about two hours
Read our Privacy Policy Contact Security Team