Scoped provider access
Connections receive only the permissions required for approved workflows. Credentials stay encrypted and server-side.
SECURITY
The owner keeps control of live business actions.
Authority is scoped, recorded, time-bounded, and stoppable. No security program eliminates every risk, so sensitive workflows fail closed and incidents remain attributable.
Controls across the whole operation
Live-action controls
Publishing, customer actions, spending, refunds, and fulfillment pass consent, budget, provider-health, and ownership checks.
Payment boundaries
Licensed providers handle card details, bank connections, payouts, and refunds. Alvanate does not store raw card numbers.
Evidence integrity
Provider receipts, payments, refunds, costs, errors, and interventions remain attributable. Unverified revenue is not confirmed profit.
Private references
Uploads are private, size-limited, scanned, and separated into observations and inferences before a change is proposed.
Account control
Users can end sessions, export data, request deletion, disconnect providers, and pause external actions.
Incident response
High and critical incidents pause affected external actions. Resuming requires a recorded reason and cleared high-severity conditions.
Report a concern
Use Account settings or email alvanatehq@gmail.com. Never include passwords or provider secrets.
Release boundary
Private founder validation is available. Public paid launch remains blocked pending legal identity and counsel review.
Security statements describe implemented product controls, not a certification claim. No third-party security certification is currently published.