Security Policy

This is the public version of how athna is secured: what we do today, in plain terms, and how to reach us if you find a problem. It's honest about being a two-person company. No SOC 2 badge yet, but the practices that lead to one.

Found a vulnerability? Tell us

Email security@athna.ai. That address, and the rest of this section, is also published at /.well-known/security.txt, the standard place security researchers look.

What helps: what you found, where, how to reproduce it, and what you think an attacker could do with it. Screenshots and a proof of concept are welcome. Your name and how you'd like to be credited, if you would.

What we'll do: reply within 2 business days, tell you what we've decided within 10, fix serious issues before anything else on our list, and credit you if you'd like that. There's no bug bounty yet; we'll say here when there is.

What we ask: don't access, change or delete data that isn't yours (make a test account); don't run denial-of-service or brute-force attacks; don't phish our users or our team; give us a reasonable time to fix it before you publish. Do that, and we won't pursue any claim against you, and we'll say so to anyone who asks. This is our safe harbor.

How your data is protected

In transit. Every connection to athna.ai and app.athna.ai is HTTPS. Nothing is served over plain HTTP.

At rest. The database, file storage and backups are encrypted by the providers that run them.

Your connected accounts. The access tokens for Instagram, TikTok, YouTube and every other account you connect are the most sensitive things we hold, so they get an extra layer: each is encrypted before it's written to the database, with a key that lives outside the database. Someone with a copy of the database has a set of ciphertext, not your accounts. Tokens are decrypted only in the moment we act for you, and deleted the moment you disconnect.

Every table is locked. The database refuses requests from anything that isn't our own server code. Row-level security is on for every table, and the public keys that reach the browser can't read anything at all.

Secrets. API keys and credentials live in a password manager and in our hosting provider's encrypted configuration. They're never in the code, never in a repository, never in a chat. Rotating one is a single change.

Your teammates. Members and editors see only what you've scoped them to see; the checks run on the server on every request, not just in the interface.

How athna itself is run

• Accounts. Two-factor authentication on every founder account at every provider. Access to production is by named account, never shared.
• Code. Every change goes through a pull request, automated checks, and a review before it reaches production. The main branch can't be pushed to directly.
• Dependencies. Updated regularly, with automated alerts for known vulnerabilities.
• Monitoring. Errors are reported to Sentry, scrubbed of content, and looked at. Unusual traffic is rate-limited automatically.
• Backups. Automatic, encrypted, and tested by restoring them. They exist to survive an outage, never to undelete something you deleted; see Data deletion.
• Providers. We build on providers with their own audited security programs (Supabase, Vercel, Cloudflare and the rest of the subprocessor list) instead of running servers ourselves.

If something goes wrong

If we confirm a breach that affects your data, we'll tell you within 72 hours: what happened, what was affected, what we've done, and what you should do. We'll tell the regulators we're required to tell, and we'll be open about what we learned.

Things you can do

• Use a password you don't use anywhere else, and a password manager.
• Turn on two-factor authentication when it's available.
• Give members and editors the scopes they need and nothing more.
• Disconnect accounts you no longer publish to.
• Revoke an API key you're not using.