Security at Aubrium
An overview of the controls, architecture, and third-party services that protect member data and payments on Aubrium.
All systems operationalLast updated August 2026
Access Control
Controls for member accounts, and for our own access.
TOTP two-factor authenticationSingle-use backup codesSession revocation controlsAutomatic session expirationAutomated abuse preventionDatabase-level access controlsEmail one-time codesSession and device managementPassword changes end active sessionsAuthentication rate limitingRisk-based sign-in controlsRole-based administrative access
Security Practices
How the platform is built, deployed and operated.
Secure management of application secretsAutomated testing before deploymentSeparate production and non-production environmentsControlled deployment and rollback processes
Data Controls
Tools and processes for accessing, exporting and deleting account data.
Self-service data exportSelf-service account deletionGDPR access and erasure rightsLimited records retained where requiredEU-hosted product analyticsMasked session replay
Subprocessors
Each provider receives only the data required for its function.
CloudflareInfrastructureIP addresses
EvervaultPCI DSS Level 1Payment Data SecurityCard data, in its certified environment
GoogleMarketing MeasurementConversion events
OpenAIAI FunctionalityPrompts and public content
AnthropicAI FunctionalityPrompts and public content
PostHogEU-hostedProduct AnalyticsPseudonymous IDs
PostmarkTransactional EmailEmail address
SupabaseDatabase & AuthenticationAccount data
TwilioPhone VerificationPhone number
VercelHosting & DeliveryRequest metadataCard data is securely handled through Evervault before being transmitted for payment processing. Collection and retention practices are described in our Privacy Policy.
Payment Security
Controls used to protect payment data and transaction processing.
Card data secured through EvervaultCard data handled within Evervault’s secure environmentTransaction records maintained for reconciliationControls against duplicate payment processingEvervault maintains PCI DSS Level 1 and SOC 2 Type II complianceEncryption in transit and at restServer-side payment verification Uptime and incidents: status.aubrium.com
Recovery & Availability
Controls supporting platform availability and recovery.
Automated database backupsContinuous uptime and availability monitoringPublic status page with incident history
Vulnerability Disclosure
Report security issues to security@aubrium.comMachine-readable security.txt publishedReasonable remediation time before disclosure