Trust & Security

We follow RFC 9116. The canonical security contact is published at /.well-known/security.txt. Email security@avnester.com for vulnerabilities; we acknowledge within 1 business day and aim to fix CRITICAL within 7 days, HIGH within 30 days, MEDIUM within 90 days.

We do not currently offer a paid bounty. We do publicly credit good-faith disclosures on this page when the reporter consents.

• DPDP-aligned consent + DSR endpoints (Prisma migration20260527130000_dpdp_consent_dsr), consent UI, audit log retention.
• OAuth 2.1 + Dynamic Client Registration + DPoP on the public MCP server.
• JWKS key rotation; tokens never leak through structured log fields.
• AWS WAF v2 with AWS Managed Core Rule Set; HTTPS-only; HSTS preload-eligible.
• CI security gates: Semgrep (SAST), tfsec (IaC), npm-audit (deps), ZAP DAST baseline + API-scan against staging.
• Threat model + pentest RFP (docs/security/threat-model.md + pentest-rfp.md). Pentest engagement signed; first report due 2026-08-01.

• SOC 2 Type 1 — readiness via Sprinto; target Type 1 issuance by 2026-09-05.
• SOC 2 Type 2 — observation window starts day Type 1 lands; report mid-2027.
• ISO 27001 — stage-1 application opens Day 60; cert target Q1 2027.
• CERT-In Vulnerability Disclosure Programme — registration submitted; awaiting confirmation badge.

For an up-to-date list of data sub-processors used by AVnester (cloud infrastructure, email, SMS, WhatsApp, payments, AI providers), email security@avnester.com. Customers on Pro and Enterprise tiers receive 30-day notice before any new sub-processor is added.