Security
Last updated September 23, 2026
Avaura separates account identity, business access, store permissions, and approval of a particular change. Each serves a different purpose.
Account and business access
Supabase Auth manages sign-in. Server-side membership checks and database row-level security restrict business access. Privileged service credentials and encrypted store credentials stay on the server. Browser sessions still use authentication tokens; keep your devices and sign-in details secure.
Approvals and verification
Connecting a store is not approval to change it. Supported consequential changes require current authority and approval of the exact proposed work. Avaura records the operation and independent readback separately. Verification that a change is present is not proof of increased sales or profit.
Operational records
Avaura keeps scoped consent, approval, execution, billing, and support records to explain important events and investigate problems. Application safeguards restrict changes to audit receipts. Diagnostic logs are separate and may be sampled; they are not a complete record of every action.
Infrastructure
Cloudflare operates Avaura’s application infrastructure. Cloudflare publishes a SOC 2 Type II report covering its assessed systems and controls. That report applies to Cloudflare’s stated scope. Avaura remains responsible for its application, access controls, configuration, and data practices.
Report a concern
Contact security@avaura.io with a short description and when it happened. Do not send passwords, sign-in links, API keys, payment details, or another merchant’s data. We may need to verify your identity before discussing account-specific information. Do not access, alter, or disclose data you are not authorized to use.
These descriptions are not a guarantee against every security incident or an uninterrupted-service commitment. See Data handling and the Privacy Policy.