Security
Built for the data you actually keep.
Aurora holds notes, conversations, and reflections you would never put in a Google Doc. We engineer accordingly.
Encrypted in transit + at rest
Your data is encrypted over TLS in transit and at rest, and isolated per-account with row-level security on every table.
Security-first architecture
Row-level security on every table, least-privilege service keys, signature-verified payment webhooks.
Managed regional hosting
Your data lives in one managed Postgres instance in Asia Pacific (ap-southeast-1), served through Vercel's edge network. Per-account region selection is not offered — ask us if residency is a requirement.
Least-privilege keys
Service-role keys never reach the client; every table enforces row-level security.
Full export, anytime
Markdown + JSON, including conversations, notes, and metadata. No lock-in.
Responsible disclosure
wavezhou6@gmail.com — we triage within 24h and pay bounties for valid findings.
Sub-processors
Who else touches your data, and why.
| Provider | Purpose | Region |
|---|---|---|
| PayPal | Payments (Subscriptions) | USA / Global |
| Resend | Transactional email | USA / Global |
| Vercel | Hosting / edge network | Global |
| Supabase | Postgres database, auth, storage | Asia Pacific (ap-southeast-1) |
| OpenRouter | Routes chat to OpenAI, Anthropic, Google, Perplexity, DeepSeek and others | Global |
| MiniMax | Text, image and text-to-speech inference | Global |
| Replicate | Image generation and note embeddings | USA / Global |
| Agnes | Video generation | Global |
Reporting a vulnerability
Email wavezhou6@gmail.com with a description and reproduction steps. We acknowledge within 24h. Valid findings receive a bounty starting at $10 and scaling with severity. PGP key on request.