Security Policy
Draft v0.1.0 · Not yet in force · Last updated 2026-07-23
Draft for review. This is a pre-launch draft pending review by qualified legal counsel. Items marked [FD-…] / [IA-…] are pending and not yet in force.
In plain English: we minimize what we hold (local-first), hash session tokens, allow instant revocation, and protect against bots and abuse. We rely on reputable infrastructure for encryption. We are not SOC 2 or ISO 27001 certified, and this is a beta.
1. Purpose and Scope
This Policy describes Auric's security posture for the beta. It states current practice and clearly labels what is planned or infrastructure-provided; it is not a warranty. Capitalized terms follow Auric's Master Definitions in the Terms of Service.
2. Confirmed Practices
- Credential handling: CLI session tokens are opaque; only their SHA-256 hash is stored, and raw tokens are never persisted. WorkOS tokens are used transiently and not stored.
- Immediate revocation: every authenticated request re-checks revocation and expiry, so revoking a session takes effect at once.
- Access model: identity is delegated to GitHub; authorization is gated by invitation; the admin console sits behind HMAC-signed session authentication.
- Abuse controls: Cloudflare Turnstile and Upstash rate limiting protect public and CLI endpoints, and forms use a honeypot.
- Data minimization: Project Data and Operational State stay on your device; the central store is deliberately limited.
- Audit trails: authentication events and session context (IP [IA-009], user agent, timestamps) are recorded.
3. Infrastructure-Provided or To Verify
Encryption in transit (TLS) [IA-001] and encryption at rest are provided at the infrastructure layer (Supabase default) [IA-002] rather than at the application layer. Backups and recovery [IA-005] and least-privilege production access [IA-006] are operational assumptions to confirm before they are relied upon.
4. What We Do Not Claim
We do not claim SOC 2, ISO 27001, penetration-test attestation, HIPAA compliance, or any uptime or SLA guarantee during the beta. Do not use Auric for regulated or safety-critical data.
5. Incident Response and Breach Notification
On a confirmed personal-data breach we contain, assess, and notify: the EEA/UK authority within 72 hours (and individuals where the risk is high); the Data Protection Board of India and CERT-In within applicable timelines, where India is in scope [FD-006]; and others as required. Report suspected issues through the Responsible Disclosure Policy.
6. Your Responsibilities
Secure the device holding your local data, protect your GitHub account, and revoke any session you do not recognize.
7. Changes and Contact
Material changes are notified per [FD-016]. Contact: security@auric.cx [FD-013].
Document control
| Field | Value |
|---|---|
| Document ID | AUR-LEG-006 |
| Version | 0.1.0 |
| Status | Draft — Pre-Counsel Review |
| Owner | Auric [FD-013] |
| Review frequency | Quarterly during beta, or on material change |
| Related documents | Privacy (002), Responsible Disclosure (007), Beta (008) |
| Applies to | Auric Closed Beta — all deployment models |
Change log
v0.1.0 (2026-07-23): Initial draft. Claims restricted to confirmed implementation.
© 2026 Auric. All rights reserved.