SECURITY
Do not trust a badge. Inspect the boundary.
Actual prototype controls and open gaps · reviewed September 18, 2026
| Control | Status | Evidence / boundary | Reviewed |
|---|---|---|---|
| Synthetic review data | Implemented | Canonical fixtures plus local CSV import; managed workspace accepts imported review exports. Use synthetic or de-identified data only. | Sep 16, 2026 |
| Managed workspace access control | Implemented; bounded tests | Password accounts, expiring HttpOnly sessions, CSRF checks and server-enforced analyst/reviewer roles. Single shared workspace; no SSO, MFA or tenant isolation. Canonical demo remains unauthenticated. | Sep 16, 2026 |
| Restricted demographic view | Demo behavior only | Presentation-only demonstration, not authorization | Sep 16, 2026 |
| Hosting / transport | Needs verification | Render configuration exists; live deployment not assessed | Sep 16, 2026 |
| Encryption at rest | Open gap | Managed records are stored in a private server file. Application-level encryption at rest is not implemented; hosting controls remain unverified. | Sep 16, 2026 |
| Retention / deletion | Open gap | Browser data can be cleared locally. Managed records require operator-controlled retention/deletion; no automated policy implemented. | Sep 16, 2026 |
| Incident response | Planned | security@avarent.app; no response SLA claimed | Sep 16, 2026 |
| Business continuity | Open gap | Server restart persistence is tested. Backup/restore procedures and hosting durability are not validated. | Sep 16, 2026 |
| Independent assurance | Open gap | Not currently SOC 2 certified | Sep 16, 2026 |
| Insurance / financial resilience | Open gap | Not evidenced in repository | Sep 16, 2026 |
| Termination / export | Implemented | Complete synthetic record and standalone calculation verifier; no production migration | Sep 16, 2026 |
Current data flow
Local CSV imports stay in the browser. Uploading an exported record to the separate managed workspace transfers it to the server for replay and persistence. No production data processing is approved. Downloaded files remain under the user’s control after browser data is cleared.
Contracting and operating evidence
Legal contracting entity, formation date, insurance, provider regions, access reviews, retention schedule, incident-notification terms, continuity tests and financial resilience are not substantiated by this prototype. These must be established before a bank procurement or non-synthetic evaluation. Contact the founders for evidence; absence is not a control.
Website services
| Provider | Purpose | Data boundary |
|---|---|---|
| Render | Configured web hosting | Public site and request handling |
| Resend | Contact delivery when configured | Work email, institution and inquiry text |
| PostHog | Allowlisted events when configured | No form contents included |
Production retention, deletion, access and subprocessor terms must be agreed before non-synthetic data is accepted.
security@avarent.app