Security overview

Security model

The most effective protection is not collecting data in the first place. Audon reads billing reports, not your traffic, and everything it holds belongs to one organization.

• Read access onlyAdmin keys are used only to read daily aggregated cost and token usage reports. We never change your provider configuration or infrastructure.
• No prompts or outputsWe don’t read prompts, responses, files or end-user data. Telemetry rejects keys that suggest content, personal data or secrets.
• Encrypted provider keysAES-256-GCM envelope encryption, a master key held apart from the database, and never shown again after you submit a key.
• Tenant isolationAll data is scoped to an organization, with automated tests against cross-tenant reads over web, REST and MCP.
• Hash-chained activity logSensitive actions are logged with actor, action, channel and request id, linked so that altering past entries can be detected.
• Roles and approvalsFive roles limit what each member can do. Optimization proposals need explicit human approval.
• Agents via scoped OAuthAgents connect over OAuth (MCP) or scoped API keys, limited to granted scopes and the authorizing user’s role.

What we don’t have yet

• We do not hold SOC 2, ISO/IEC 27001 or any other security certification.
• We have not yet commissioned an independent penetration test or external security audit.
• We do not offer data residency in the UAE, Saudi Arabia, the UK or the EU.
• We are a small team. We do not operate a 24/7 security operations centre.
• We do not currently run a paid bug bounty.

If any of this changes, we will update this page and say what was done, by whom and when.

Least data, read-only

• Read-only connectors. We use the OpenAI Organization Admin API key and the Anthropic Claude Platform Admin API key you provide only to read daily aggregated cost and token usage reports (by project or workspace, model, line item and API key id). We do not read prompts, responses, files or end-user data, and we never change your provider configuration or infrastructure.
• No content telemetry. The optional Telemetry API accepts only operational fields (run and workflow ids, status, verification type, estimated cost, token counts, retry and tool-call counts, and up to 20 operational metadata keys). It rejects metadata keys that suggest prompts, content, personal data or secrets. Raw prompt capture is not offered.
• No AI processing of your data. We do not send customer data to any LLM or AI model, and we do not train models on it. See the AI Data Use Policy.
• No third-party trackers. We use no analytics, advertising or session-replay tools.

Protecting provider credentials

Provider admin keys are the most sensitive data we hold. Because those keys may permit more than read access at the provider, we treat them accordingly:

• Keys are envelope-encrypted with AES-256-GCM before storage: each secret is encrypted with a data key, which is itself encrypted with a master key held separately from the database.
• Keys are never returned to browsers, Agents, API responses or logs after submission. The interface shows only a masked identifier.
• Outbound connector requests go only to official provider API hosts over HTTPS.
• Disconnecting a connector destroys the encrypted key and stops all future synchronization.

Infrastructure

The full list, with the data each vendor processes and where, is the Subprocessors list on the DPA page.

Application security controls

Encryption in transit

All traffic to the Services uses TLS.

Authentication

Passwords are hashed with scrypt. Sessions use a random token in an HttpOnly, Secure, SameSite=Lax cookie; only a hash of the token is stored, sessions expire after 14 days, and sessions are validated server-side on every request. Audon API keys are stored only as hashes.

Authorization (RBAC)

Each organization member has one role:

Agents

AI agents connect through OAuth (MCP) or scoped API keys. Each Agent action is limited to its granted scopes and to the authorizing user’s role, and is attributed in the activity log to that user. Deleting an organization requires a signed-in human owner, and optimization proposals require explicit human approval. Removing a member revokes their API keys and Agent access.

Tenant isolation

All data is scoped to an organization. We run automated tests intended to prevent one tenant from reading or enumerating another tenant’s data through web, REST or MCP routes.

Abuse and injection defences

Rate limiting on authentication, API and MCP routes; idempotency keys for state-changing API calls; payload size limits; a server-side request forgery (SSRF) guard on outbound requests; signed outbound webhooks; and treatment of all customer-supplied metadata as data, never as instructions.

Audit trail

Sensitive actions are recorded in an activity log with the actor, action, channel and request id. Entries are linked by a tamper-evident hash chain so that alteration of past entries can be detected. Logs exclude secrets and authorization headers.

Data lifecycle

Incident response

If we become aware of a security incident affecting customer data, we will investigate, contain and remediate it, and notify affected customers as set out in the DPA (Section 8), including what happened, what data was affected and what we are doing.

Reporting a vulnerability

Please report suspected vulnerabilities to To be confirmed: support contact email with “Security” in the subject line. Our security.txt always names the current contact. Please give us reasonable time to fix the issue before disclosure, do not access or modify other customers’ data, and do not degrade the Services. We will not pursue action against good-faith research that follows these principles.

Your responsibilities

Security is shared. You are responsible for:

• deciding whether to provide provider admin keys, and rotating or revoking them;
• assigning appropriate roles and removing users who no longer need access;
• protecting passwords and Audon API keys, and reviewing connected Agents and their scopes;
• not submitting prompts, personal data or secrets in Telemetry;
• setting spending limits directly with your AI providers (our alerts monitor spend; they do not block it); and
• reviewing the activity log for unexpected actions.