Security
1. Access control
- Two-factor sign-in. Every platform administrator signs in with two-factor; the administration API refuses one who has not turned it on. New accounts require two-factor for everyone in them, and an account owner can require it on any account: a person without it can do nothing but turn it on.
- Accounts are separate. Every database statement passes a query plane that refuses one without the account it belongs to, so one customer's data cannot be read under another's session. An agency works in a client's account only while the client relationship is active, and only on positioning, evidence and Radar.
- Sessions and keys are stored as digests. Sign-in sessions, API keys and support links are kept as SHA-256 hashes; a copy of the database yields no usable credential. Support access to a customer's account is checked against the account's support code when one is issued, opens through a one-time link good for two minutes, and is logged.
- Least access. API keys and assistant connections carry only the scopes granted. Spending AI on an account needs its own scope.
- Sign-up is checked for a person (Cloudflare Turnstile) and needs a confirmed email before any AI is used. Sign-in, sign-up and reset are rate limited per address.
2. Data protection
- Traffic is encrypted in transit (TLS, HSTS). HubSpot connection tokens and webhook signing secrets are encrypted at rest with AES-256-GCM under a master key held in a separate secrets service.
- Credentials live in that secrets service, scoped to the service that needs each one, never in code.
- Your content is yours. It is sent to an AI provider only for the request you make, and not used to train models. Every AI call is metered against your account.
- Who else processes data, and how long each kind is kept: see the Privacy Policy.
3. Backup and recovery
- The database is backed up daily by PlanetScale and backups are kept for up to 30 days. Our monitor checks the age of the newest backup and alerts when it is late.
- A full restore is tested every quarter: the newest backup is restored to a separate branch, checked to read back, and the time it took is recorded.
- Last restore test: not yet recorded.
4. Incident response
- The platform is watched around the clock: failures, unusual AI spend, sign-up bursts and data-boundary refusals raise alerts by email, and the most severe by text message.
- On a suspected incident we contain it first (revoke credentials, switch off the affected feature), then investigate from the audit and request logs.
- If customer data is affected, we tell the account holders affected without undue delay, with what happened, what was involved and what we are doing, and follow up when the investigation is complete.
Reporting a vulnerability
Write to support@mxaura.ai with "security" in the subject. We acknowledge within one business day. Please do not test against other customers' accounts or data.