Security & Vulnerability Disclosure

Security overview

• •Hosting & network: AWS (us-east-2) with EKS for container orchestration; ALB ingress with TLS 1.2/1.3; Route53 DNS; ACM certificates.
• •Data protection: Encryption in transit (TLS) and at rest (AWS KMS). Secrets via AWS Secrets Manager and synced with External Secrets Operator. Minimal data retention for diagnostics.
• •Access control: Principle of least privilege; IAM Roles for Service Accounts (IRSA); OIDC-based CI/CD to avoid long-lived keys.
• •Application security: Non-root containers, read-only filesystems, dropped Linux capabilities, network policies with egress-only defaults, IMDS access blocked, zero-trust segmentation.
• •Change management: GitOps with ArgoCD, Kustomize overlays, progressive rollouts, zero-downtime deployment strategy, health/readiness probes, kill-switch feature flag.
• •Observability & incident response: Sentry for application errors, crashes, release health, and selected traces; Better Stack for uptime, heartbeats, private status page, and incident routing; structured logging with correlation IDs.
• •Data stores: MongoDB Atlas (primary DB), Redis (cache/locks) for ephemeral caching. Backup and restore procedures are maintained and tested periodically.
• •Optional mobile & future entitlements: optional iOS surfaces may use APNs push delivery; RevenueCat may support future subscription entitlements if paid plans launch.
• •AI & telephony providers: OpenAI (AI inference / live conversation processing, if applicable) and Twilio (telephony, call routing, callback handling, and carrier lifecycle). We configure providers to process content solely to deliver services and opt out of model training where available.
• •Analytics: PostHog for product/website analytics; LaunchDarkly for feature flags. No interest-based ad tech.

Responsible vulnerability disclosure

We welcome good-faith reports of security issues. If you believe you've found a vulnerability, please email privacy@avaplicity.com with the subject line "Vulnerability Report: [short title]" and include:

• •Impacted domain/app, endpoint or component, and environment (prod/stg if known).
• •Detailed steps to reproduce; minimal proof-of-concept; screenshots or logs.
• •Observed impact and suggested severity (CVSS v3.1 vector if you use it).
• •Your contact info for coordination.

Please do not share details publicly until we confirm a fix or provide coordinated disclosure timing.

Safe harbor (good-faith research)

If you follow the guidelines below, we will not pursue legal action or contact law enforcement regarding your research, and we will consider your testing authorized for the limited purpose of responsible disclosure:

• •Only test against assets in scope (see "Scope").
• •Avoid privacy harm: do not access, modify, or exfiltrate data that is not your own. If you inadvertently access data, stop immediately and report.
• •No service disruption: do not perform DDoS, brute-force, spam, resource exhaustion, or any testing that degrades availability.
• •No social engineering, phishing, physical intrusion, or threats of any kind.
• •No extortion or ransom demands; your communication must be in good faith.

This safe-harbor promise does not apply to actions that violate laws beyond what is necessary for legitimate testing or to testing outside the defined scope.