Security Policy

This Policy describes Auric's security posture for the beta. It states current practice and clearly labels what is planned or infrastructure-provided; it is not a warranty. Capitalized terms follow Auric's Master Definitions in the Terms of Service.

• Credential handling: CLI session tokens are opaque; only their SHA-256 hash is stored, and raw tokens are never persisted. WorkOS tokens are used transiently and not stored.
• Immediate revocation: every authenticated request re-checks revocation and expiry, so revoking a session takes effect at once.
• Access model: identity is delegated to GitHub; authorization is gated by invitation; the internal console has no shared password — each operator signs in to their own account, passwords are stored only as memory-hard scrypt hashes, and console sessions are opaque tokens of which only a SHA-256 hash is kept.
• Abuse controls: Cloudflare Turnstile and Upstash rate limiting protect public and CLI endpoints, and forms use a honeypot.
• Data minimization: Project Data and Operational State stay on your device; the central store is deliberately limited.
• Audit trails: authentication events and session context (full IP address, user agent, timestamps) are recorded.

Traffic is encrypted in transit with TLS, and database connections require it. Encryption at rest is provided by our database host at the infrastructure layer; Auric adds no separate application-layer encryption, and we would rather say so than let you assume otherwise. Backups are those our database host provides. We do not claim a formal, tested disaster-recovery process, and we will not describe one relied upon.

We do not claim SOC 2, ISO 27001, penetration-test attestation, HIPAA compliance, or any uptime or SLA guarantee during the beta. Do not use Auric for regulated or safety-critical data.

On a confirmed personal-data breach we contain, assess, and notify: the EEA/UK authority within 72 hours (and individuals where the risk is high); and any other authority as required. Report suspected issues through the Responsible Disclosure Policy.

Secure the device holding your local data, protect your GitHub account, and revoke any session you do not recognize.

If these terms change materially we will update the effective date on this page and, where the change affects you meaningfully, tell you by email before it takes effect. Contact: security@auric.cx.

2 September 2026: The beta is described as private throughout, which is how access is actually granted — requested, confirmed, then opened in waves. No right, obligation, party or data practice changed.

1.3.0-beta.1 (2026-08-02): Published for the private beta. Review markers resolved against the implementation, unsupported AI-provider claims removed, and retention stated from the constants that enforce it.