How Aura protects your data.

The controls below are implemented, not aspirational.

• Encryption in transit and at rest.

• Row-level security on every user-owned table, with automated cross-user isolation tests.

• Server-side secrets only; the mobile app never holds a privileged key.

• Session tokens stored in the device keychain, never in plain storage.

• Sensitive values redacted from logs and crash reports.

• Dependency and secret scanning on every pull request.