Security at Convora

1. Data Encryption

All data handled by Convora is encrypted using industry-standard protocols:

• In transit: All connections use TLS 1.3 with strong cipher suites. HTTP Strict Transport Security (HSTS) is enforced across all endpoints.
• At rest: All stored data — including documents, embeddings, conversations, and metadata — is encrypted using AES-256 encryption.
• API keys: Stored using one-way hashing. We never store API keys in plaintext.
• Passwords: Hashed using bcrypt with appropriate work factors.

✓ TLS 1.3 ✓ AES-256 ✓ HSTS

2. Infrastructure & Isolation

Our infrastructure is designed with security and isolation as core principles:

• Tenant isolation: Each workspace operates in a logically isolated environment. Data, embeddings, and configurations are strictly separated per tenant.
• No cross-tenant access: It is architecturally impossible for one tenant to access another tenant's data, even in the event of a software bug.
• Network security: Internal services communicate over private networks. Public-facing endpoints are protected by rate limiting and DDoS mitigation.
• Minimal attack surface: Only necessary ports and services are exposed. All others are firewalled by default.

3. AI Data Privacy

We understand that your data is sensitive. Here's our commitment:

• No model training: Your documents, conversations, and data are never used to train or fine-tune any AI models — ours or third-party.
• Ephemeral processing: When your data is sent to AI providers (Groq, Google Gemini) for inference, it is processed in real-time and not retained by those providers.
• Data minimization: We only send the minimum context necessary to generate accurate responses.
• No data sharing: Your data is never shared with other customers, partners, or third parties for any purpose other than providing the Service.

🛡️ Zero training data policy

4. Access Controls

Multiple layers of access control protect your account and data:

• JWT authentication: Secure, stateless token-based authentication with short-lived access tokens and refresh token rotation.
• API keys: Scoped API keys with configurable permissions for programmatic access.
• Role-based access: Granular permissions system — workspace owners, admins, and members have different access levels.
• Session management: Automatic session expiration and the ability to revoke all active sessions.
• Rate limiting: Intelligent rate limiting to prevent brute-force attacks and API abuse.

5. Compliance

We are committed to meeting industry security standards:

• SOC 2: We are actively working toward SOC 2 Type II certification. Our security controls are designed to meet SOC 2 Trust Service Criteria.
• GDPR-ready: Our data handling practices are designed to comply with GDPR requirements, including data subject rights, data minimization, and breach notification.
• DPA available: We offer a Data Processing Agreement for customers who require one.

🔄 SOC 2 in progress ✓ GDPR-ready ✓ DPA available

6. Vulnerability Reporting

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue:

• Email us at hello@convora.ai with the subject line "Security Vulnerability"
• Include a detailed description of the vulnerability and steps to reproduce
• Allow us reasonable time (90 days) to address the issue before public disclosure
• Do not access, modify, or delete other users' data during testing

We commit to:

• Acknowledging receipt within 48 hours
• Providing regular updates on remediation progress
• Not pursuing legal action against good-faith security researchers
• Crediting researchers (with permission) in our security advisories

7. Data Residency

Currently, Convora's infrastructure is hosted on cloud providers with data centers in multiple regions:

• Primary data storage and processing occurs on cloud infrastructure
• Vector embeddings are stored on Qdrant Cloud
• AI inference is processed through Groq and Google Cloud

We are working on offering data residency options for enterprise customers who require data to remain in specific geographic regions. Contact us at hello@convora.ai for enterprise data residency requirements.

8. Regular Security Updates

Security is an ongoing process, not a one-time effort:

• Dependency updates: We regularly update all dependencies and monitor for known vulnerabilities (CVEs).
• Security patches: Critical vulnerabilities are patched within 24 hours of discovery.
• Infrastructure updates: Operating systems and runtime environments are kept up to date.
• Code review: All code changes go through security-focused review before deployment.
• Monitoring: Continuous monitoring for anomalous activity, unauthorized access attempts, and system health.