Security and Responsible Disclosure

Aulay holds your agent transcripts and the credentials your agents use. This page says what we do to protect them, what we have not done yet, and how to tell us if you find something.

Reporting a vulnerability

Email security@aulay.io. Include enough detail to reproduce the issue. We will acknowledge within 3 working days and keep you updated until it is resolved.

We do not run a paid bug bounty. We will credit you publicly if you would like, and we will not pursue anyone who reports a genuine issue in good faith and who:

• only ever accesses their own account and their own data;
• stops as soon as they have confirmed the issue, without extracting more data than needed to demonstrate it;
• does not degrade the service for other users — no denial of service, no automated scanning at volume, no social engineering of our users or providers;
• gives us a reasonable chance to fix it before disclosing publicly.

What we do

• Everything is encrypted in transit. HTTPS everywhere, with TLS terminated at our edge and re-established internally.
• The API denies by default. Every endpoint requires an authenticated caller unless it is explicitly and deliberately public, and each request is checked against the caller’s own scope before any data is returned.
• Passwords are hashed with a modern algorithm. We cannot read yours.
• Sign-in is rate-limited per address and per account, with a lockout that does not reveal whether an account exists.
• Secrets you store are encrypted at rest with authenticated encryption.
• Backups are encrypted and off-site, and their restoration is rehearsed.
• Actions are audited. Every change is recorded with the account that made it. The audit log deliberately does not capture request contents.
• Desktop credentials use the operating system keychain rather than a file we invented.

Known limitation

When you sign in to an AI command-line tool inside a session, Aulay can capture that tool’s sign-in state so the session survives a rebuild. That captured state is not yet encrypted at rest. It is held in our database, reachable only through authenticated, account-scoped access, but it does not have the additional encryption layer that your named secrets do.

We are telling you this because you would want to know, and because a security page that only lists strengths is not a security page. If it concerns you, you can delete stored sign-in state at any time and re-authenticate each session by hand. We are working on this.

What we do not claim

Aulay is early-access software built by a small team on a single-region cluster. We have no third-party security certification, no SOC 2 report, and no formal penetration test to show you. We would rather say that plainly than imply otherwise.

If you are evaluating Aulay for something where those things matter, they do not exist yet. Ask us at security@aulay.io and we will give you a straight answer about where we are.

If something goes wrong

If we become aware of a breach affecting your personal data we will notify you and the relevant supervisory authority as required by law, and tell you what happened, what was affected, and what we are doing about it.