Security
How we protect your data
| Area | What we do |
|---|---|
| Transport | TLS 1.2+ on every endpoint, HSTS, automatic certificates |
| API keys | Shown once, stored only as a SHA-256 hash and a 12-character prefix |
| Sign-in | No passwords. Single-use email links valid 15 minutes, or Google and GitHub |
| Sessions | Signed, http-only, secure cookies. CSRF tokens on every change |
| Money | Integer amounts and an append-only ledger. Every balance change is one row |
| Access | Staff access is logged in an audit log. Production access uses keys and two-factor sign-in |
| Data | Encrypted disks, nightly encrypted backups, outputs deleted after 30 days |
| Hosting | One provider in the EU (Germany) |
Report a vulnerability
Email security@tovano.ai. Please include steps to reproduce and give us 90 days to fix it before you publish. We answer within two working days and will credit you if you wish.
Machine-readable contact: /.well-known/security.txt.
Out of scope
Denial of service, social engineering of staff, and findings from automated scanners without a proof of impact.