Security

Your data stays yours.

What we do with your data, where it lives and who can see it. Plainly, and only what's true today.

01

Access

  • Sign-in with email and password, with email confirmation. Sign-up is by invitation.
  • Four roles, per organisation and per workspace: Owner, Admin, User and Viewer. Nobody can grant a role above their own.
  • Roles are enforced in the database itself, on every table, not only in the app.
  • Invitations work once, expire after 7 days, and only for the email they were sent to. Removing someone takes effect within 15 seconds.
  • An audit log records who changed what.
02

Your connections

  • Credentials for your sources are encrypted with AES-256-GCM before they're stored, and are never sent to the browser or to the AI.
  • Avir reads from your sources; it doesn't write your business records back to them. Live sync from Postgres adds a publication and a replication slot, and you can import read-only instead.
  • Outbound requests can only reach public addresses: private networks, cloud metadata and internal names are blocked, every DNS answer is checked.
  • Error messages are scrubbed of connection strings and passwords.
03

AI

  • Avir AI runs on Anthropic's Claude or OpenAI's models, through their business APIs.
  • Your data isn't used to train AI models, by us or by our AI providers.
  • Each workspace chooses whether the AI may read full record values, or only field names, subjects and short previews.
  • Every AI run shows its cost before it starts, and is metered per organisation.
04

Hosting and backups

  • Hosted on Fly.io in the United States, on two or more machines with rolling deploys. The graph database that holds your records is only reachable on a private network.
  • Everything is served over HTTPS, with HSTS, strict security headers and rate limits on every request.
  • Daily encrypted snapshots of the database, kept for 14 days. Restores are rehearsed: the last one took about a minute and a half.
  • Health is checked every 15 seconds; failures alert the team by email.
05

Your data, your call

  • An owner can delete the organisation at any time. Its records, links and files are purged, and leave backups as they expire.
  • Anyone can delete their own account.
  • After an agreement ends, customer data is deleted within 30 days.
  • We report a breach that affects your data within 72 hours.

Subprocessors

Who helps us run Avir.

All in the United States. We give customers 30 days' notice before adding a new one.

Fly.io
Hosting
Tigris Data
Data files and backups
Supabase
Sign-in, organisations and roles
Anthropic
Avir AI
OpenAI
Avir AI, when it runs on an OpenAI model
Stripe
Payments
Resend
Email
Cloudflare
This website

Report a vulnerability

Found something? Tell us.

Write to hello@avirhq.com with "Security" in the subject. We'll acknowledge within two working days, keep you posted while we fix it, and credit you if you'd like. Please don't access other customers' data or disrupt the service while testing.

Data processing terms

Test a decision on your own customers.

Test a decisionPricing