Loading...
Loading...
Last updated
Operational data — accounts, listings, inquiries, payments, audit logs — is stored in AWS Asia Pacific (Mumbai), region ap-south-1. A subset of processing (error monitoring, AI inference for traffic initiated from the Anthropic or OpenAI APIs, transactional email) is performed by sub-processors outside India under written data-processing contracts. Full provider list: /privacy § Sub-processors.
ELBSecurityPolicy-TLS13-1-2-2021-06, AEAD-only suites)..tfvars files committed to git. AWS Secrets Manager + Terraform data sources throughout.agent_tool_calls + Cognito group membership).beforeSend interceptor plus NestJS request scrub on Authorization headers and OAuth params (code, state, code_verifier).AVnester operates under Indian law and is designed to meet the “reasonable security practices and procedures” standard required by IT Act §43A and the IT (Reasonable Security Practices) Rules, 2011, and the safeguards required by DPDPA §8. Internal controls map to ISO/IEC 27001 Annex A categories (access control, cryptography, operations security, supplier relationships, incident management) — we are not currently ISO 27001 / SOC 2 certified, and we will not represent otherwise until an independent audit is complete.
Security incidents and confirmed personal-data breaches are triaged immediately by the founder-led on-call. Personal-data breaches affecting users are notified to the Data Protection Board of India and impacted users without undue delay, in line with DPDPA §8(6). Reportable cyber incidents are notified to CERT-In within the timelines set by the CERT-In Directions of 28 April 2022.
Vulnerability disclosure: security@avnester.com. We acknowledge within 48 hours, triage within 5 business days, and provide a remediation timeline for confirmed issues. Critical exploitable issues (RCE, broken auth, sensitive-data exposure) target 7-day remediation; high-severity 30 days; medium 90 days.
We welcome good-faith security research. AVnester will not pursue civil or criminal action against researchers who:
security@avnester.com and give us a reasonable window to remediate before any public disclosure.The public connector ships with three independent kill switches (env-flagged, no redeploy needed): full-surface disable, anonymous-tier disable, and reviewer-bypass toggle. All three are exercised against staging before submission.
Vulnerability disclosure: security@avnester.com