Security
Last updated: June 2026
How we protect your account and data. Security is a practice, not a checkbox, this reflects our current measures.
Authentication
Passwords are hashed with bcrypt. Sessions use short-lived (15-minute) access tokens with rotating, revocable refresh tokens. Login is rate-limited and returns identical errors whether the email exists or the password is wrong, so it can't be used to discover accounts. Deleting your account immediately invalidates every outstanding token.
API keys
API keys are shown once and stored only as SHA-256 hashes, we cannot recover a key, only verify it. Revoking a key takes effect immediately.
In transit & in the app
All traffic is served over HTTPS with HSTS. Responses carry a strict Content-Security-Policy and standard hardening headers. Request bodies and query lengths are bounded, and chat content is rendered as sanitized text, never as raw HTML.
Billing safety
Spend caps are enforced atomically so concurrent requests can never exceed your limit. Payment webhooks are signature-verified and processed exactly once. Card data is handled solely by Stripe.
Reporting a vulnerability
We welcome responsible disclosure. Email security@aletheonsolutions.com with details and steps to reproduce; please give us reasonable time to remediate before public disclosure. Our API-key prefix is registered with GitHub's secret-scanning program.