← Back to AuraLeads AI

Security Overview

Last updated: September 27, 2026

This page describes the real, specific measures in place today — not a generic security-policy template. We're a small, independently-run product, not a SOC 2 or ISO 27001 certified organization, and we won't claim otherwise.

Credentials and connected accounts

  • LinkedIn/Instagram session cookies and Gmail App Passwords are encrypted at rest with AES-256-GCM before they're stored — never saved in plain text.
  • OAuth connections (Instagram, WhatsApp, X) use official provider OAuth flows; the X connection specifically uses OAuth 2.0 with PKCE. We never see or store your actual platform password for those.
  • Provider API keys and our database service-role credentials are held as server-side environment variables and are never sent to your browser.

Data isolation between customers

Every workspace's data — leads, messages, templates, settings — is enforced at the database level with Postgres Row Level Security, scoped to your own workspace membership. This means a bug in our application code isn't the only thing standing between your data and another customer's; the database itself refuses cross-workspace reads and writes.

Payments

Card, UPI, and PayPal details are handled entirely by PayPal and Razorpay directly — we never see or store your payment credentials. Which plan gets granted after checkout is decided from what our server recorded at the moment you started the checkout, verified against a cryptographic signature from the payment provider, never from anything the browser sends us afterward.

Webhooks

Inbound webhooks (Instagram, WhatsApp, Razorpay) verify a cryptographic signature from the sender using a timing-safe comparison before any payload is processed — an unsigned or incorrectly-signed request is rejected outright.

Infrastructure

  • Hosted on Vercel with HTTPS/TLS enforced everywhere (HSTS enabled).
  • Standard security headers are set on every response: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and frame-ancestors protection against clickjacking.
  • Rate limiting is applied to AI-generation and other cost-sensitive endpoints to limit abuse.

What we can't promise yet

We don't currently have a formal third-party security audit, a bug bounty program, or a compliance certification. If you find a real security issue, we want to know before anyone else does.

Report a security issue

Email contact@auraleads.online with details. Please don't test against other customers' accounts or data — use your own account when investigating something.