1. Our Commitment to Security
At AuraKin AI, we understand that you are entrusting us with your family's most sensitive information — from health records and personal details to private messages and photos. We take this responsibility seriously and have implemented comprehensive, multi-layered security measures to protect your data at every level.
2. Authentication & Access Control
🔐 Secure Authentication
- Passwords are hashed using bcrypt with a cost factor of 12, making brute-force attacks computationally infeasible
- Support for Google SSO and Apple Sign In for secure, passwordless authentication
- Secure session management with encrypted, HTTP-only session tokens
- All authentication flows handled by the industry-standard NextAuth framework
👥 Granular Family Permissions
- Family owners have full control over what data each member can see and edit
- Per-member access controls for children, pets, calendar, and more
- All API endpoints enforce permission checks server-side — visibility restrictions cannot be bypassed by the client
- Default permissions are restrictive (read-only, no add/edit) until explicitly granted by the owner
3. Data Protection
🔒 Encryption
- All data in transit is encrypted using TLS/HTTPS with HSTS enforcement (max-age 1 year)
- Database connections are encrypted
- File uploads are transferred securely via pre-signed URLs directly to encrypted cloud storage (AWS S3)
- Payment information is handled entirely by Stripe — we never store credit card numbers
🛡️ Application Security
- CSRF Protection: All state-changing API requests are validated against origin headers to prevent cross-site request forgery
- Input Sanitisation: User inputs are sanitised to strip malicious scripts, iframes, and event handlers, preventing XSS attacks
- Rate Limiting: Signup and sensitive endpoints are rate-limited to prevent brute-force attacks (5 requests/minute per IP)
- Security Headers: X-Content-Type-Options (nosniff), Strict-Transport-Security, Referrer-Policy, and Permissions-Policy headers on all responses
- API Cache Control: All API responses include
no-store, no-cache, must-revalidate headers to prevent sensitive data caching
4. Monitoring & Auditing
📋 Audit Logging
- Security-relevant actions are logged to an audit trail including user ID, action type, resource, IP address, and user agent
- Audit logs help detect and investigate suspicious activity
- Logs are retained for security analysis and compliance purposes
5. Infrastructure Security
- Hosted on enterprise-grade cloud infrastructure with automated scaling and redundancy
- Database access restricted to application services only — no public exposure
- File storage uses private S3 buckets with signed URLs for time-limited access to private files
- Environment secrets (API keys, database credentials) are stored securely and never exposed to the client
- Google Calendar tokens are stored server-side and refreshed automatically — users can revoke access at any time
6. Payment Security
- All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor
- We never receive, process, or store your full credit card number
- Webhook signatures are verified to prevent fraudulent payment notifications
- Subscription management (cancellations, updates) is handled through Stripe's secure Customer Portal
7. What You Can Do
We recommend the following best practices to keep your account secure:
- Use a strong, unique password for your AuraKin account
- Consider using Google or Apple Sign In for the strongest authentication security
- Review family member permissions regularly and remove members who should no longer have access
- Keep your email address up to date so we can reach you about important security notifications
- Log out when using shared or public devices
- Report any suspicious activity to our security team immediately
8. Responsible Disclosure
If you discover a security vulnerability in AuraKin AI, we encourage responsible disclosure. Please report it privately to our security team rather than publishing it publicly. We are committed to investigating and addressing all legitimate reports promptly.
9. Contact Our Security Team
For security concerns, vulnerability reports, or questions about our security practices: