Awrora

Last updated 29 October 2026

Security

Awrora is operated by UL CORP LTD. English is the controlling language of these documents.

This page summarizes how UL CORP LTD protects Awrora. It is informational and does not expand warranties beyond the Terms of use.

1. Sign-in and account security

  • Passwords are stored as one-way hashes, never in plaintext.
  • Optional Google OAuth sign-in when enabled for the deployment.
  • Session cookies identify signed-in users; sessions can be invalidated on sign-out or suspected compromise.
  • Workspace owners control invitations and roles; staff only see modules granted to their membership.
  • Use a unique, strong password and protect devices used for back-office access.

2. Application controls

  • HTTPS/TLS for data in transit.
  • Security headers and rate limiting on sensitive API routes.
  • Multi-tenant isolation by organization; property scoping where enabled.
  • Server actions and APIs check authentication and authorization before mutating data.
  • Confirm-before-write patterns for Mayday AI so automated suggestions do not silently move money or inventory.

3. Payments and secrets

  • Card data is handled by PCI-oriented payment providers; we do not store full PAN or CVV.
  • API keys and webhook secrets for channels, messaging, and billing are stored as server-side configuration — never exposed in client bundles intentionally.
  • Do not paste live secrets into guest-facing notes or AI prompts.

4. Customer responsibilities

  • Grant least-privilege roles to staff and revoke access when people leave.
  • Keep connected OTA, channel, and messaging credentials rotated and limited in scope.
  • Verify identity documents and guest data according to your local law before relying on them.
  • Export critical records on a schedule that matches your business continuity needs.

5. Incident reporting

If you discover a vulnerability or suspect unauthorized access to your workspace, contact us immediately via the contact page. Please include enough detail to reproduce the issue and avoid accessing other customers’ data.

6. Related policies

Privacy · DPA · Acceptable use · Cookies

Back to Awrora

Security · Awrora