← Back to aserva
Security at aserva
aserva handles your customers' conversations and order context. This page describes the controls that protect them — in plain language, without overclaiming.
Tenant isolation and access
Strict multi-tenant isolation
- •Every record is scoped to your organization; the tenant key is always derived from the authenticated session, never from request input.
- •Vector search namespaces, caches, and rate-limit buckets are partitioned per organization.
- •Two-tenant live isolation is verified with automated proof checks, not assumptions.
Authentication and RBAC
- •Dashboard access uses Supabase Auth with JWT session validation and middleware session refresh.
- •Roles: owner, admin, agent, viewer — with granular permission checks on sensitive operations.
- •Public API keys are stored as SHA-256 hashes; the plain key is shown exactly once at creation.
Data protection
Encryption and secrets
- •Third-party integration credentials are encrypted at rest with AES-256-GCM.
- •Secrets are never logged; automated audits scan the repository for leaked credentials and known advisories.
- •Data in transit is TLS-only across app, API, widget, and webhook surfaces.
PII handling
- •AI guardrails scrub sensitive data patterns (card numbers, government IDs, phone, email) before LLM processing.
- •GDPR webhook compliance endpoints are implemented for Shopify (customer data request, redact, shop redact).
- •Customers can request data export and deletion through platform-mandated flows.
AI and action safety
Approval-gated commerce actions
- •Refunds, returns, cancellations, exchanges, and discounts are proposed — never executed autonomously.
- •Widget confirmations require signed, purpose-bound, scoped, short-lived, one-time action tokens.
- •Merchant and platform automatic-action switches both default to OFF.
- •Every action proposal, confirmation, and rejection is written to an immutable audit log.
Webhook and abuse protection
- •All provider webhooks (Shopify, Stripe, email, Facebook, Instagram, and Zid) are signature-verified or authenticated before processing.
- •Idempotency keys and replay protection on delivery-sensitive endpoints.
- •Rate limiting with sliding windows on public AI endpoints and the public API.
- •CSRF protection and strict route audits run in CI on every change.
Operational policies
- •Incident response policy — severity ladder (SEV1-4), the alerting that actually runs, escalation path, postmortems, and status communication.
- •Data retention policy — retention per data category, grounded in the actual data model, including what is and is not deleted automatically today.
- •Subprocessor list — providers the platform actually uses, categorized by role, with integration surfaces listed separately.
Subprocessors
aserva uses the following subprocessors to deliver the service. This list is kept current; material changes are announced before they take effect. The detailed subprocessor page adds purposes, data categories, and integration surfaces.
| Subprocessor | Purpose | Data region |
|---|---|---|
| Supabase | Authentication and PostgreSQL database hosting | United States |
| Vercel | Application hosting and CDN | United States |
| Upstash | Redis cache, rate limiting, session memory | Global (AWS us-east-1) |
| Pinecone | Knowledge base vector storage | United States |
| Moonshot AI (Kimi) | Primary LLM inference | Provider-managed |
| OpenAI | Fallback LLM and image analysis | United States |
| Resend | Outbound email delivery | United States |
| Sentry | Error monitoring and diagnostics | Provider-managed |
Connected commerce platforms (Shopify, Salla, Zid, WooCommerce) process data under their own terms when you link your store.
Compliance status
- •GDPR: platform-mandated data request and redaction webhooks implemented; PII scrubbing in the AI pipeline.
- •SOC 2: not yet certified. The controls above are implemented and tested in CI (route audits, credential audits, dependency advisories); certification is on the roadmap and this page will be updated when obtained.
- •Data residency: primary infrastructure in US regions; EU residency planning is available for enterprise discussions.
Found a security issue?
We run a coordinated disclosure process. Please report vulnerabilities privately and allow time for remediation before public disclosure.
Contact the security team