Security and Responsible Disclosure
A factual overview of controls present in the current release, and limitations that customers should review before use.
Current technical controls
- Browser authentication uses HttpOnly cookies with CSRF checks for unsafe cookie-authenticated requests; SDKs can use bearer JWTs or project keys.
- Project API keys are stored as one-way hashes. Project-owned provider credentials are encrypted at rest using the deployment's Fernet key and are write-only in the portal.
- Project and organization access is scoped by backend authorization checks. Protect v2 detection events can be configured for retention or zero-retention mode.
- Agent authorization events use the platform's hash-chained audit log where that workflow is used.
Certifications and contractual terms
Aynigma is not SOC 2 certified and does not currently offer a HIPAA business associate agreement. No third-party penetration-test report, public status page, published incident-response SLA, or complete verified subprocessor list is available through this site. Request current evidence and contractual terms before relying on the service for a regulated workload.
Report a potential vulnerability
Use the website contact form at https://aynigma.ai/#contact to request a private reporting channel. Include a short summary and the affected public URL only. Do not include credentials, personal data, PHI, customer prompts, data dumps, or exploit payloads in the general form. The form is not an emergency channel; no acknowledgement or remediation timeframe is promised. Do not access, alter, or retain data that is not yours.
Responsible testing
Test only systems you own or have explicit written permission to assess. The published contact route is for reporting; it does not grant authorization to scan Aynigma or third-party infrastructure.
Request current security evidence
Ask for information relevant to your proposed use before sending confidential or regulated data.