Security Policy

How we protect your vault — and how to tell us when something looks off.

Last updated: May 6, 2026

Aevio Health holds your meals, training, supplements, biometric history, and uploaded medical documents. That data deserves a security posture that takes itself seriously. This page describes what we do, what we ask of you, and how to report issues.

Our security practices

Aevio Health is built on a small, auditable surface. We rely on battle-tested managed infrastructure and enforce defense-in-depth at every layer.

  • TLS 1.3 for all connections, HSTS preloaded
  • AES-256-GCM at-rest encryption for OAuth refresh tokens
  • Magic-link signin — we never store passwords
  • Row-level access controls on every user-scoped table
  • Strict access boundaries enforced at signin, OAuth flows, and MCP JWT verify
  • JWT verification via JWKS for MCP requests
  • Rate limiting per-user and per-IP on all public endpoints
  • Refresh-token rotation on every use, with replay detection

Data protection

Sensitive data is encrypted in transit and at rest. Database access is restricted to the application service role; ad-hoc queries route through audited admin tools.

  • All inbound and outbound traffic encrypted with TLS 1.3
  • Sensitive secrets stored in our hosting platform's encrypted env store
  • OAuth tokens encrypted before reaching the database
  • Sessions secured with HTTP-only, SameSite=Lax cookies
  • Third-party integrations gated through OAuth with explicit consent
  • Daily cleanup of expired auth artifacts (state codes, sessions)

About OAuth tokens for the wearables you connect:

Refresh tokens are encrypted with AES-256-GCM using a master key held in our hosting platform's encrypted env store. The decryption key never touches the database. Tokens rotate on every use; if a refresh token is presented twice, the entire integration is revoked and you are notified.

Authentication and access

Authentication is enforced at every boundary: signin, OAuth login, OAuth callback, and MCP JWT verification. Requests that do not match the expected scope or audience are rejected before reaching any user data. Per-tenant Row Level Security policies isolate data at the database layer.

Reporting vulnerabilities

We welcome reports from the security community. We do not currently run a paid bug bounty, but we will publicly credit researchers (with consent) for valid findings.

How to report:

  • Email security@aevio.health (PGP optional, on request)
  • Include a clear description, impact, and reproduction steps
  • Provide proof-of-concept code or HTTP traces if relevant
  • Allow us reasonable time to investigate and remediate
  • Do not exfiltrate user data or pivot beyond what's needed for the proof
  • Do not publicly disclose until we've shipped a fix

Our machine-readable contact is published at /.well-known/security.txt.

Your responsibilities

Security is a shared concern. The platform handles the engineering side; you handle the human side.

  • Use a unique email address protected by 2FA
  • Treat magic links as sensitive — do not forward them
  • Revoke OAuth integrations you no longer use
  • Log out from shared or temporarily-trusted devices
  • Report suspicious activity at the first sign

Security updates and incident notification

We continuously monitor and improve our security posture. When we identify issues, we ship fixes quickly and coordinate disclosure with the reporter. For incidents that may affect your account or data, we will notify you by email without undue delay and no later than 72 hours after becoming aware, in line with GDPR Article 33.

Contact us

For security reports, write to security@aevio.health. For privacy questions, see our Privacy Policy.