What we do
Encrypted credentials
WordPress credentials, Google Analytics and Search Console keys and webhook headers are encrypted at rest.
Account protection
Passwords are hashed with bcrypt. One-time codes are stored hashed and have limited attempts. Sessions use short-lived tokens that are revoked when you change your password.
Abuse protection
Sign-in and sensitive endpoints are rate limited, and the API sets standard security headers.
Scoped access
Each business is a separate workspace. Team members get role-based access inside it.
Your data and AI
Your Brand Context and agent outputs are used to serve your account. They are not used to train models for other customers. You can edit your Brand Context at any time.
Reporting a vulnerability
If you believe you have found a security issue, email info@aethriss.com with the details. Please give us reasonable time to investigate before disclosing publicly.