Security Overview

In place today

Transport encryption

Traffic to the site and application is served over HTTPS.

Encryption at rest

Our managed database and file storage encrypt data at rest as provided by the platform. This is not end-to-end encryption: we can access stored data in order to operate the service.

Row-level access control

Database policies are written so that a member's profile records are readable and writable only by that member's own authenticated session.

Private photo storage

Profile photos live in a private bucket with no public URLs, and are served through short-lived signed links.

Server-side authorisation

Server functions that touch member data require a verified session before they run, and validate their inputs.

Log redaction

Server-side logging passes through a redaction step intended to strip email addresses, identifiers, and tokens before anything is written.

Bot protection and rate limiting

Waitlist, sign-up, sign-in, and password-reset flows use a managed challenge verified on the server, and sensitive actions are rate-limited.

Credential handling

Passwords are stored as salted hashes by our authentication provider. Privileged keys are held as server-side secrets and are never sent to the browser.

Administrative access

Privileged operations are gated behind a check that requires an administrator session with multi-factor authentication.

Planned, not yet in place

• A documented and rehearsed incident response procedure.
• Independent penetration testing and third-party security review.
• Formal vulnerability management with tracked remediation targets.
• Centralised security monitoring and alerting.
• A formal information security policy set and staff security training.

Certifications

nu Avanti does not hold SOC 2, ISO 27001, or any equivalent certification, and this page does not claim compliance with any security framework.

Report a vulnerability→

Protecting your own account→