Security at Aubrium
How Aubrium handles account security, member data and payments.
All systems operationalLast updated August 2026
Access Control
- Authentication
- Two-factor authentication using an authenticator app or email codes, with single-use backup codes.
- Sessions
- View devices and revoke sessions from your account. Inactive sessions expire automatically, and password changes end other sessions.
- Abuse prevention
- Sign-in rate limits, bot checks and automated risk checks.
- Database access
- Access restrictions are enforced at the database level.
Security Practices
- Application secrets
- Credentials are stored outside application code.
- Environments
- Production and non-production environments are kept separate.
- Deployments
- Automated tests run before deployment. Previous deployments can be restored.
Data Controls
- Export and deletion
- Export your data or delete your account from account settings.
- Data rights
- Access and erasure rights under GDPR.
- Retention
- Some records are retained for legal and fraud-prevention purposes. See our Privacy Policy
- Analytics
- Product analytics are hosted in the EU.
Subprocessors
Each provider receives only the data required for its function.
| Provider | Purpose | Data processed |
|---|---|---|
 Cloudflare | Infrastructure | IP addresses |
| StripePCI DSS Level 1 | Payments | Card and payment details |
 Google | AI features and marketing measurement | Prompts, public content and conversion events |
 Meta | Advertising measurement | Conversion events |
 OpenAI | AI features | Prompts and public content |
 Anthropic | AI features | Prompts and public content |
 PostHog | Product analytics (EU-hosted) | Usage data |
 Postmark | Transactional email | Email address |
 Supabase | Database and authentication | Account data |
 Twilio | Phone verification | Phone number |
 Vercel | Hosting and delivery | Request metadata |
See our Privacy Policy for data collection and retention details.
Payment Security
- Card data
- Cards are entered in Stripe's own secure form and never touch our servers.
- Encryption
- Encryption in transit and at rest.
- Payment processing
- Payments are verified on the server, with checks to prevent duplicate processing.
- Transaction records
- Transaction records are kept for reconciliation.
Recovery & Availability
- Backups
- Automated database backups.
- Monitoring
- Continuous availability monitoring. Incident history is published on our status page
Vulnerability Disclosure
Report security issues to security@aubrium.com
Please report vulnerabilities privately and allow time for investigation and remediation before public disclosure.
Security contact details are also available in security.txt