Security

Genuine AI does not currently hold its own SOC 2, ISO 27001, or similar attestation, and we do not claim one. When a first-party audit completes, this page will link the report. Until then, every statement below is either something we implement directly or an attestation held by a named provider, cited as an infrastructure dependency — never as our own certification.

The service is hosted on Vercel, whose platform maintains SOC 2 Type 2, ISO 27001, and PCI DSS attestations (see security.vercel.com). Those attestations cover Vercel's platform — not this application. Our subprocessors are listed in the Privacy Policy.

Data is encrypted in transit using TLS 1.2+ and at rest using AES-256 on our infrastructure. [VERIFY ENCRYPTION COVERAGE FOR ANY APP-MANAGED DATABASE BEFORE PUBLISHING.]

• Security response headers (HSTS, content-type protections, referrer policy) on every response
• Passwords stored only as salted hashes; no plaintext credential storage
• Principle of least privilege for internal access; secrets held in managed environment configuration
• Dependencies monitored for known vulnerabilities and updated on a regular cadence
• Demo input is forwarded to the configured AI provider — or its configured fallback provider if the primary fails — to generate the rewrite, and is not stored by us; server logs record request metadata only, never the submitted text

Your writing samples are used only to serve you and are never used to train models for other customers. Retention windows and deletion mechanics are documented in the Privacy Policy.

If a security incident affects your data, we will notify affected users without undue delay and within the timelines applicable law requires, with a description of what happened, what data was involved, and what we are doing about it.

Found a vulnerability? Report it to hello@auradev.ai. We commit to acknowledging reports within 3 business days, not pursuing legal action against good-faith research, and crediting reporters who want credit once a fix ships.