Safety & Security at Aurry
Last updated: Aug 10, 2025
We handle sensitive health data and AI-driven insights with a security-first mindset across our products, infrastructure, and operations. Here’s how we keep you safe.
Defense-in-depth
Environment isolation, short-lived credentials, and continuous monitoring across the stack.
AI done responsibly
Aurora provides guidance, not medical advice — with human-in-the-loop UX and opt-in training.
Privacy by design
Granular consent, access controls, and audit logging — with export and deletion on request.
Our Security Posture
Encryption
TLS in transit; strong encryption (e.g., AES‑256) at rest for databases and object storage.
Isolation
Segregated environments for dev/stage/prod; least‑privilege IAM and network segmentation.
Secrets
Centralized secrets management, short‑lived credentials; no secrets in code.
Monitoring
Centralized logs, anomaly detection, and alerting for critical paths.
Backups & DR
Regular encrypted backups with tested restore and disaster‑recovery drills.
AI Safety & Model Use
Human‑in‑the‑loop
Aurora offers guidance, not medical advice. UX encourages consultation with clinicians.
Data boundaries
No identifiable health data used for model training without explicit opt‑in.
Safety filters
Policy and safety guardrails to reduce harmful or misleading outputs.
Transparency
AI usage is labeled with clear purpose and limitations.
Data Handling & Privacy
Minimal collection
Only what’s needed for the features you choose (e.g., connected providers, devices).
Consent controls
Granular permissions and the ability to revoke connections.
Access controls
Role‑based permissions with audit logging.
Portability & deletion
Data exports and deletion on request — see our Privacy Policy.
Availability & Incidents
24/7 monitoring
Critical systems and dependencies are continuously monitored.
Runbooks
Documented incident response with severity classification and on‑call escalation.
Post‑incident reviews
Corrective actions for material incidents are documented and tracked.
Compliance
HIPAA
Considerations for applicable data flows and Business Associate relationships.
Security controls
Controls mapped toward SOC 2‑style principles (access, logging, change mgmt).
Regional privacy
Requirements (GDPR/EEA, CCPA/CPRA) reflected in our Privacy Policy.
We do not claim certification or attestation unless explicitly stated.
FAQ
Do you use my data to train AI?
How do I report a security issue?
How can I delete my data?
Responsible Disclosure
We deeply appreciate security researchers who help keep our users safe. If you believe you’ve discovered a vulnerability, please email security@aurry.co with details and steps to reproduce. We ask that you avoid data access beyond your own, avoid disruption, and give us reasonable time to remediate before disclosure.
We’ll acknowledge receipt within a few business days and keep you informed throughout remediation.