Your business data. Our responsibility.
Can we safely put our business and customer data into AuroLead AI? Here is how AuroLead AI protects your data today. Have a question that isn't answered here? Contact our team.
Encryption in transit and at rest
- All production traffic is served over HTTPS/TLS; authentication cookies are marked secure and are never sent over plain HTTP.
- Passwords are never stored in plain text — they are hashed with Argon2id. Session and password-reset tokens are stored only as SHA-256 hashes.
- Payment provider credentials (API keys, webhook secrets) are encrypted at rest and are never returned in plaintext by any API or shown again once saved.
- The primary database runs on Supabase (PostgreSQL), which encrypts data at rest on the underlying AWS infrastructure.
Authentication, access control and roles
- Short-lived JWT access tokens (15 minutes) in httpOnly cookies, with rotating refresh tokens and reuse detection.
- CSRF protection via a double-submit cookie/header on every state-changing request.
- Role-based permissions (System Administrator, Company Administrator, Sales Manager, Sales Representative, Viewer) scope what each user can see and do.
- Accounts lock out after repeated failed sign-in attempts, and authentication endpoints are rate-limited.
- Every company’s data is tenant-scoped at the query level, so one customer can never see another’s records.
- Payment provider configuration (API keys, enable/disable, live-mode) can only be changed by a System Administrator.
Payments and billing
- We never store raw card numbers, CVVs or other sensitive payment instrument data — these are handled directly by our payment providers.
- Payment completion is always verified server-side (provider webhook signature verification or a server-side status check); a browser redirect or client-side success message is never trusted to grant paid access.
- Every checkout is tied to the requesting company and plan on the server, with built-in protection against duplicate submissions and replayed/duplicate payment confirmations.
- Test-mode payments used for development and demos are confined to non-production environments and can never activate a live subscription.
Data storage and hosting
- Application data is hosted on Supabase (managed PostgreSQL on AWS infrastructure).
- Uploaded files (e.g. sales spreadsheets) are stored in dedicated, access-controlled application storage, not publicly accessible.
- We do not sell or share customer data with third parties.
Data sourcing and verification
- Dealer and business records are sourced only from publicly accessible URLs — company websites, dealer locators and public directories — never from private or gated systems.
- Each sourced business is cross-checked against Google’s Business Profile data (Places API) to verify its name, address and operating status before it is published in AuroLead AI.
- Records that cannot be verified against a public source are flagged for manual review instead of being published automatically.
Backup, disaster recovery and incident response
- Database backups are managed through our hosting provider as part of its standard backup and point-in-time recovery capabilities.
- Application code and infrastructure configuration are version-controlled, enabling fast, repeatable recovery.
- Suspected security incidents are triaged promptly and affected customers are notified without undue delay.
- Enterprise customers can request our current backup frequency, retention and recovery-time details.
Vulnerability reporting and security contact
- We welcome responsible disclosure of security issues from customers and researchers.
- Report a vulnerability or security concern to sales@auroleadai.in and we will acknowledge it promptly.
- Please avoid accessing or modifying data that is not your own while testing, and give us a reasonable time to respond before public disclosure.
Compliance certifications
- We do not currently hold third-party compliance certifications such as SOC 2 or ISO 27001.
- As the platform grows we plan to pursue certifications relevant to our customers, and will update this page as that happens.
- Enterprise customers can contact us to complete a security questionnaire or request additional documentation.