Security

How Aavan protects the evidence you trust it with.

Evidence you can verify

• Evidence is append-only: the application's database role cannot update or delete it.
• Every record is linked in a per-customer hash chain, so any edit, deletion or reordering is detectable.
• Control results can be re-derived from the recorded evidence and checked against the stored result.

Access and isolation

• Every query is scoped to the customer's workspace.
• API keys are stored as hashes, shown once at creation, and can be limited to read-only.
• The service refuses to start if its database role has more rights than it needs.
• The Jira app requests no permission to read or change your Jira issues. Requests from Jira are verified with Atlassian's signed invocation tokens.

Credentials and data

• Connector credentials (for example a GitHub token) are encrypted with AES-256-GCM using per-customer keys, and are never returned by the API or written to logs.
• Traffic is encrypted in transit with TLS.
• People's usernames are kept out of the permanent record (a pseudonym is stored instead), so they can be erased on request without breaking the evidence chain.
• Email addresses and commit message bodies are not collected.

Reporting a vulnerability

Email hello@aavan.app with the details. Please don't test against other customers' data.