Security by architecture, not by policy.

Data minimization

• Classification runs entirely on-device. Raw text never leaves the browser.
• Only 5 fields transmitted: label, domain, action, timestamp, SHA-256 hash
• AIovert cannot reconstruct any original content from what it receives

Infrastructure

• Data stored in EU-region infrastructure (AWS eu-central-1, Frankfurt)
• Encryption in transit via TLS 1.3; encryption at rest via AES-256
• Row-level security isolates each organization's data at the database layer

Application security

• Chrome Manifest V3 extension: no remote code execution, strict CSP enforced
• Extension reviewed under Google's Chrome Web Store security policies
• No network proxies, no certificate installation, no traffic interception required

Access controls

• Least-privilege access to production systems; no standing admin sessions
• MFA enforced across all team members and critical service accounts
• Production access audit logs retained; quarterly access reviews performed

Incident response

• GDPR breach notification initiated within 72 hours of confirmed discovery
• Named security lead with a documented escalation path
• Post-incident reviews shared with affected customers including root-cause analysis

Organizational

• Background checks for all employees and contractors with system access
• Annual security awareness training for the full team
• Vendor risk assessments required before engaging any new sub-processor