Security
Security claims should be specific and verifiable. Alvorant uses encryption, access controls, audit history, signed webhooks, rate limiting, and private file storage as implemented in the product.
Encryption
Connections use TLS in transit and production storage is configured for encryption at rest. Private files are delivered through time-limited signed URLs.
Role-Based Access
Owner, Admin, Member, and Viewer roles are enforced server-side on protected account actions.
Audit Logging
Significant account and support actions are recorded with timestamps and available context for auditability.
Data Validation
Server-side validation on all form submissions. Zod schema validation for all AI-generated configurations.
Rate Limiting
20 submissions per 10 minutes per IP per form. Burst-oriented protection against abuse.
Webhook Security
HMAC SHA-256 signed webhooks with timestamp and event ID. Bounded retries with exponential backoff.
Honeypot Protection
Invisible honeypot fields to catch automated bot submissions without affecting real users.
Private File Storage
Uploaded files stored in private cloud storage. Served only via time-limited signed URLs.