Security
How Avyn protects your account, your apps and their data, stated as what the product does today.
Signing in without a password
Your Avyn account has no password. You sign in with a code or a link sent to your email, with a passkey you add in Settings, with another account the sign-in screen offers, or through your organisation's single sign-on. An app you build can offer password sign-in to its own users; those passwords are kept in that app's own database, not in Avyn's.
Where your data is kept
Your Avyn account, each app's database and your published apps are hosted in Sydney. The AI builder and its build workspaces run on US services, so your description, your onboarding answers, what you type to the builder and your app's code are processed in the United States. Product analytics runs on PostHog in the United States.
A separate database for every app
Each app's data is kept in its own Neon database project, apart from Avyn's own records and from every other app.
Row-level security
Row-level security is switched on for every table of Avyn's own records, so the database itself decides which rows a signed-in person can read, and a table with no policy for signed-in people is readable only by Avyn's own server.
Secrets are encrypted
Secrets you add to an app are encrypted with AES-256-GCM before they are stored, bound to that app and that name, so a copied value never decrypts anywhere else.
App keys
Each app's keys to Avyn's runtime are checked against a SHA-256 hash, and the key itself is kept only encrypted with AES-256-GCM, bound to that app, so it can be given to the app again when it publishes. The key a preview uses is limited more tightly than the published app's key.
Keys kept away from the AI
When Avyn builds an app, the values of Avyn's own keys, tokens and secrets are masked before the build's text reaches the AI model, the build's event log or the generated app.
Card details stay with Stripe
Plans and credits are paid on Stripe's own checkout and billing pages, so card details go to Stripe and never reach Avyn.
Security headers for your app
Each published app can send Strict-Transport-Security, X-Frame-Options and Permissions-Policy headers. They are off until you turn them on in the app's More > Security, and each applies from the next publish.
Runtime logs
A published app's runtime logs are kept for 7 days, then deleted.
Reporting a security problem
If you find a security problem in Avyn, tell us through Help and feedback in the app, with the steps to reproduce it.