Aviloza
Security
Last updated: 18 October 2026
This page describes the safeguards the product runs today. It is not a certification, not a penetration-test report, and not a promise of absolute security. Account controls — connections, sign-out and account deletion — are available after sign-in at /security.
Separation between users
User data is separated by account. A signed-in user is not supposed to read another user's rows. Connection secrets, including OAuth tokens, are not readable through the user's ordinary session.
Encrypted credentials
Google tokens are encrypted at rest with AES-256-GCM. The encryption key stays on the server. The tokens are not sent to the browser.
External actions
A model may propose an action. Server code decides whether it runs. An external send or write goes through an authority check, and through approval where the product requires it. Emergency Stop is there to block new actions that mechanism supports. Content that arrives from email, a calendar or an external page is data, not authority.
Google user data
Use of Google user data is described in the Privacy Policy, including the Google API Services User Data Policy and Limited Use. Disconnect and deletion are described in the retention section.
Known limit
An operational record from 11 September 2026 said leaked-password protection in the sign-in settings was still off. This page does not claim that setting has been turned on since. Turning it on is an owner configuration step, not a change made by this page.
Report a problem
Do not send secrets, passwords or tokens in a report.