Security
Built for the data you actually keep.
Aurora holds notes, conversations, and reflections you would never put in a Google Doc. We engineer accordingly.
Encrypted in transit + at rest
Your data is encrypted over TLS in transit and at rest, and isolated per-account with row-level security on every table.
Security-first architecture
Row-level security on every table, least-privilege service keys, signature-verified payment webhooks.
Regional data residency
Pick US, EU, or Asia Pacific at signup. Your data never leaves your region.
Least-privilege keys
Service-role keys never reach the client; every table enforces row-level security.
Full export, anytime
Markdown + JSON, including conversations, notes, and metadata. No lock-in.
Responsible disclosure
wavezhou6@gmail.com — we triage within 24h and pay bounties for valid findings.
Sub-processors
Who else touches your data, and why.
| Provider | Purpose | Region |
|---|---|---|
| PayPal | Payments (Subscriptions) | USA / Global |
| Resend | Transactional email | USA |
| Vercel | Hosting / edge | Global |
| Supabase | Database (region of your choice) | US / EU / APAC |
| OpenAI / Anthropic / Google / Perplexity | AI inference (zero retention) | Per request |
| Sentry | Error tracking | EU |
Reporting a vulnerability
Email wavezhou6@gmail.com with a description and reproduction steps. We acknowledge within 24h. Valid findings receive a bounty starting at $10 and scaling with severity. PGP key on request.