You trust Aventide with real information about your business, your clients and your money. We protect it at every layer: an independently assessed app, encrypted data, firm walls between businesses, and an AI whose drafts for clients wait for your approval. This page explains how.
Independently assessed
Aventide has completed Google’s Cloud Application Security Assessment (CASA) under the App Defense Alliance (ADA), at Assurance Level 1 (AL1). It was validated in September 2026 by TAC Security, an independent assessor authorized by the App Defense Alliance.
CASA is the security assessment Google requires before an app may use restricted Google data, such as Gmail. It’s based on the OWASP Application Security Verification Standard and covers sign-in and sessions, access control, encryption, protection against malicious input and secure configuration. As part of it, the live app was scanned with the App Defense Alliance’s own audit scan configuration.
The short version
Independently assessed. Google CASA at Assurance Level 1, validated by TAC Security in September 2026.
Encrypted in transit and at rest. The keys to your connected accounts sit in an encrypted secrets store.
Walled off. Our server checks which business you belong to on every request. Browsers can’t change our database directly.
No passwords or card numbers stored by us.
AI that asks first. Aventide’s AI uses your sign-in, stays inside your business, and asks before it sends, publishes, shares, cancels, voids or deletes anything.
Locked vault items stay out of Aventide’s AI, except a Smart Compliance scan you choose.
Every code change is checked. No app code ships until it passes automated security, test and build checks.
In the United States, on audited infrastructure. Our app servers and database run in the United States, on providers with independent SOC 2 Type 2 audits.
Found a security issue? Email support@aventide.ai. Good-faith research is welcome (see the rules below).
For your security review
If a client or their IT team is checking Aventide, this is what we can show today. We hold one independent assessment of our app, we run on audited infrastructure, and we publish the documents a review asks for. We will never claim a certification we don’t hold, and we answer security questionnaires by email.
Independent assessment: Google CASA, Assurance Level 1, validated by TAC Security in September 2026.
Infrastructure audits: Vercel, Supabase, Anthropic and Cloudflare each publish an independent SOC 2 Type 2 report; Stripe is certified PCI DSS Level 1 and QuickBooks Payments is a PCI DSS compliant processor, both on the owner’s own account; card details are tokenized on their side and payouts go straight to the owner’s bank.
Sub-processors: the full list of companies that handle your data, with what each one does, on our sub-processor page.
Data Processing Addendum: our DPA for customers who need one, including the transfer terms our providers sign.
Where data lives: the United States (Vercel, Supabase on AWS), backed up daily and kept 7 days.
Your data, out: the account owner can have a ZIP of the account’s data emailed from Your data, in the profile menu, or ask us for a full copy by email.
Your data, gone: deletion on request by email, confirmed in writing.
If something goes wrong: we tell you by email without undue delay; for your clients’ data, we aim for 24 hours and never more than 72.
E-signatures: consent and disclosure before signing, a frozen copy, an append-only record with the signer’s IP and time, and a SHA-256 fingerprint on every signed document, as the US ESIGN Act and UETA require.
Your sign-in: sign in with Google, which carries your Google 2-step verification, or with an emailed link; passwords are checked and stored by Outseta, never by us.
Questionnaires: send us yours (SIG Lite, CAIQ, your own) and we answer it. support@aventide.ai
We’re a US company and our customers are in the United States first. For anyone who needs it, we provide the pieces the GDPR and the CCPA ask of a provider: a Data Processing Addendum, a public sub-processor list, a copy of your data on request, deletion on request, breach notice within 72 hours, and no sale of personal data, ever.
Encrypted, in transit and at rest
Every connection between your browser and Aventide is encrypted (HTTPS/TLS), and our app tells browsers never to connect any other way.
Stored data is encrypted at rest by the providers that hold it: Supabase for our database and some files, and Cloudflare for most uploaded files.
The keys that connect your other accounts, like Google, get extra protection. They live in an encrypted secrets store (Supabase Vault), apart from your regular data. Only our server reads them, and they’re never sent to your browser. A few others, such as note-taker API keys and Slack tokens, we also encrypt ourselves (AES-256-GCM) with a key kept outside the database.
Where your data lives
Our app servers (Vercel) and our database (Supabase, on Amazon Web Services) run in the United States. The database is backed up every day, and each backup is kept for 7 days.
One business, walled off from every other
We check every request on our server. When you sign in, our server confirms who you are and which businesses you can see. Every read and write after that is limited to the business you’re working in. This is enforced in our server code, never left to your browser or to the AI. Nothing you or your teammates do in the app reaches another business’s data.
The database itself is a second wall. Browsers can’t write to it at all: every change goes through our server. Browsers can read only the few tables that power live updates, and only their own account’s rows. New tables start closed to browsers.
Inside a business, personal things stay personal. If you connect your own Gmail, only you can see your email. If you connect your own Google Calendar, teammates see your events only as busy time.
Live document editing runs on private channels. Only signed-in people who can already open a document can join its live updates.
Safe links for your clients
Your clients sign, pay, book and view what you share without an Aventide login. Those pages use long, random links that can’t be guessed, with more protection on top:
Signing links expire after 14 days if unsigned. A signed copy stays available at its link.
Client portal sign-in links expire after 7 days.
File downloads use signed links that expire.
Pages where clients sign, pay, view shared documents or manage a booking can’t be loaded inside another website.
Signing, shared-document and client portal links limit repeated attempts.
Sign-up, log-in, password reset, booking, inquiry and form submissions pass a bot check (Cloudflare Turnstile).
Where we rate-limit by IP address, we store the address only in hashed form.
Public booking and form pages can be embedded on any website. That’s on purpose, so you can put them on your own site. The signed-in app is built to load inside our own website, aventide.ai, and its main screens refuse to load inside other sites.
AI that stays in its lane
It uses your sign-in. When Aventide’s AI does something for you, it passes the same server checks you do, so it can only reach the business you’re working in.
It asks first. Aventide drafts freely, then asks for your approval before it sends an email or invoice, publishes or schedules a post, shares a document, books or cancels a meeting, voids a contract or invoice, or deletes a client, document, invoice or business. A contract goes to a client only after someone on your team countersigns it in the app.
It treats outside content as information. Content from outside, like incoming email, is labelled as information to read, not instructions to follow. That makes it much harder to slip the AI hidden commands. No AI is immune to that kind of trick, which is one more reason the approval step exists.
Your data doesn’t train AI models. Our AI runs on Anthropic’s Claude models, usually reached through Vercel’s AI Gateway, which may also use the same models hosted by Amazon Bedrock or Google Vertex AI. None of them trains its models on data sent through their commercial services, and we don’t train AI models on your data either. Your chats are saved so you can come back to them. The monitoring records we keep about how the AI ran have the prompts and replies stripped out.
The Vault
Items you lock in the Vault, like your EIN or license files, are kept out of Aventide’s AI features. Think, Sidekick, document runs and the Daily Brief don’t read them.
One exception, which you choose: when you ask Smart Compliance to scan a document for dates, the file goes to our AI provider (Anthropic) so it can read it. We tell you this before your first scan.
Locking is an access setting, not extra encryption. Locked items are stored like the rest of your data, encrypted at rest by our providers, and access to stored data is limited to authorized personnel for support, security and legal reasons. If you unlock an item and lock it again, anything the AI already saw while it was unlocked (in a past chat, for example) stays where it is.
Records you can rely on
When you send a contract, Aventide freezes a copy, and the signer reviews and signs that exact copy. Database rules block any change to a sent or signed contract, and its signing history can only be added to, never edited. Each signed document carries a SHA-256 fingerprint, so a changed copy can be detected. Invoice and document histories are append-only too.
The most dangerous data, we don’t hold
The safest data is data we never keep.
No stored passwords. Login runs through Outseta, which checks and stores passwords. When you sign in with a password, it passes through our server over an encrypted connection on its way to Outseta. We don’t keep it or log it. You can also sign in with Google or an emailed link.
No card numbers. Card payments run through Stripe, which is certified PCI DSS Level 1. We keep Stripe’s reference IDs and payment details like amounts, dates and status, never card numbers.
No bank logins. If you link a bank account (through Stripe), we store balances and transactions so Money can show them. We never get your bank login.
Your money stays yours. Your clients’ payments go into your own Stripe account: the one you already have, connected through the Aventide Stripe App, or one we set up for you on Stripe. Aventide doesn’t hold the money and takes no cut. Refunds and disputes are handled in Stripe.
Deleting your data
When you delete something Aventide remembered about you or your business, we record a marker so the AI doesn’t quietly learn it again.
Deleting a business in the app archives it. It disappears from your account, but its data is kept until your account is deleted.
We keep your data while your account is active. The account owner can get a copy from Your data, in the profile menu: a ZIP with each business’s facts, clients, documents, contracts, invoices, bookings, signed agreements and files, emailed as a download link, with a note inside that lists what it leaves out. For a full copy, or to delete your account and everything in it, email support@aventide.ai from your account’s email address. We’ll confirm it’s you and erase it within 30 days. Today our team does this by hand. Signed agreements and their signing records are deleted with the account, so we email the account owner first with a reminder to download any they want to keep. Deleted data can stay in our database provider’s backups for up to 7 days, until they’re overwritten. We keep our own billing records, and anything else the law requires.
Built on audited infrastructure
We build on providers that run security at scale:
Provider | What it does for us |
|---|---|
Vercel | Hosts the app and routes AI requests (AI Gateway) |
Supabase | Database, some file storage, live updates |
Cloudflare | Most file storage and delivery, bot checks |
Anthropic | AI models (Claude) |
Amazon Web Services / Google Cloud | Backup hosts for the same AI models (through Vercel’s AI Gateway) |
Outseta | Login and subscription billing |
Stripe | Payments, for our billing and for your clients’ payments |
Resend | Email we send to you and on your behalf |
Vercel, Supabase, Anthropic and Cloudflare each publish independent SOC 2 Type 2 reports, and Stripe is certified PCI DSS Level 1. Those audits cover their own systems; our CASA assessment covers Aventide’s own app. The full list of providers that handle personal data is on our sub-processor page.
How code ships
Every change to our main codebase goes through a pull request, and it can’t merge until it passes a required automated gate:
a scan for known-vulnerable dependencies, which blocks any high or critical issue unless we’ve reviewed it and set a date to look at it again;
code linting;
thousands of automated tests;
a full production build.
The dependency scan also reruns every week against our live code, so a new advisory surfaces even when no change is in progress. Database changes are applied to the database first, then kept as migration files in our code history and tested against a fresh database on every pull request.
Every code change must pass these automated security, test and build checks before it can ship, whether a person or an AI assistant wrote it. A second person’s review isn’t required on top of them.
What we don’t have yet
Our own SOC 2 report. Our core providers have theirs, and CASA covers our app. We’ll never claim a certification we don’t hold.
A penetration test. CASA at Assurance Level 1 validates our security controls. It isn’t a penetration test, and we haven’t commissioned one yet.
A paid bug bounty. We welcome reports (below), but we don’t pay for them yet.
Keys only you hold. Locking a Vault item controls who and what can use it. It doesn’t make it unreadable to us.
Need a security questionnaire answered, or a walk-through of our setup? Email support@aventide.ai.
If something goes wrong
If a security incident affects your data, we’ll tell you by email without undue delay, and as the law requires. If it affects information about your clients, we aim to tell you within 24 hours, and always within 72 hours of becoming aware of it, with what you need to notify them. Our Data Processing Addendum has the details.
Found a security issue?
Email support@aventide.ai with “Security” in the subject line. Tell us what you found, how to reproduce it, and any link or account involved. If you’re not sure whether something is in bounds, email us first.
What we ask
Test only with your own account (a free trial is fine) or data you have permission to use.
Don’t access, change, keep or share other people’s data. If you reach someone else’s data by accident, stop, don’t keep it, and tell us.
Don’t disrupt the service. No denial-of-service, spam or heavy automated scanning.
No social engineering of our team or customers, and no physical attacks.
Give us a reasonable chance to fix the problem before you share details publicly. We aim to fix valid reports within 90 days, and we’ll keep you posted.
What we promise
We’ll acknowledge your report within 5 business days and keep you updated.
Safe harbor. If you make a good-faith effort to follow these rules, we’ll treat your research as authorized. We won’t take legal action against you or ask law enforcement to act against you over it, including under anti-hacking or anti-circumvention laws. If someone else takes action over your research, we’ll make it known that you acted with our permission.
This covers Aventide’s own systems only. We can’t authorize testing of our providers’ systems (like Vercel, Supabase, Cloudflare, Outseta or Stripe); they have their own rules.
We don’t offer payment for reports right now, but we’re grateful for them.