---
title: Security Overview
description: Learn how Avra ensures the confidentiality, integrity, and availability of your data.
sidebar:
  label: Overview
---

At Avra, security is foundational to our platform and culture. Our information security management system (ISMS) is built on leading global standards, including **ISO 27001:2022** — for which certification is currently in progress — and the **NIST Cybersecurity Framework (CSF) 2.0**. Our approach is built on the core principles of Confidentiality, Integrity, and Availability (the CIA triad).

**[Avra's Trust Center](https://trust.avra.ai)**

Access our trust center to learn more about Avra's security practices.

Discover

## Key Pillars of Our Security Program

### Confidentiality

We ensure that your data is accessed only by authorized users.

- **Encryption**: Data is encrypted both **in transit** using TLS 1.2+ and **at rest** using industry-standard AES-256 encryption. Our cloud storage (for example, AWS S3) uses server-side encryption with keys managed by AWS Key Management Service (KMS).
- **Principle of Least Privilege**: Access to data and systems is granted on a strict need-to-know basis.
- **Role-Based Access Control (RBAC)**: A robust RBAC model with automated, group-based permissions ties access to each user's role and revokes it on departure.
- **Data Isolation**: Customer data is logically isolated and never exposed to or used by other customers. The Relational Foundation Model can additionally be deployed inside your environment for full physical custody. See [Data Privacy & Compliance](/pt-BR/security/data-privacy-and-compliance) for details.

### Integrity

We maintain the accuracy and consistency of your data throughout its lifecycle.

- **Immutable Audit Logs**: All API calls and sensitive actions are logged to a tamper-evident audit trail. Customer-visible events are available in the dashboard under Observability → Audit.
- **Input Validation**: Data is validated against predefined schemas upon ingestion to prevent corruption.
- **Version Control**: Our models and infrastructure are managed as code (`IaC`) and follow git-based workflows with mandatory peer review to ensure changes are deliberate and tracked.

### Availability

We design our systems for resilience to ensure you have reliable access to our services.

- **Multi-Cloud Architecture**: We operate across multiple top-tier cloud providers to build a resilient and scalable infrastructure with no single point of failure.
- **High Availability**: Our services are deployed across multiple availability zones (AZs) with auto-scaling and health checks to handle failures gracefully.
- **Disaster Recovery**: We have comprehensive backup and disaster recovery plans that are regularly tested to ensure business continuity.

## Secure Development & Operations

- **Employee Security**: All employees undergo background checks and receive regular security awareness training. Multi-Factor Authentication (MFA) is mandatory for access to all critical systems.
- **Vulnerability Management**: We continuously scan our code and infrastructure for vulnerabilities and have a clear policy for responsible disclosure. See our [Vulnerability Disclosure Policy](/pt-BR/security/vulnerability-disclosure-policy).
- **Third-Party Audits**: We engage independent third-party auditors to perform penetration tests and security assessments to validate our controls.

For further questions about Avra's security posture, please contact us at `security@avra.ai` or visit our [Trust Center](https://trust.avra.ai).