Security Architecture

AUX STUDIO builds web applications on Vercel's global Edge Network, benefiting from distributed point-of-presence (PoP) termination, automated DDoS mitigation, and continuous edge isolation. - Transport Security: Strict HTTPS with HTTP Strict Transport Security (HSTS) enforced across all production domains; - TLS 1.3: Modern cipher suites guaranteeing Perfect Forward Secrecy (PFS); - Automated Edge Filtering: Instant mitigation against volumetric DDoS and Layer 7 bot attacks before requests reach serverless functions.

Our persistent relational and vector data resides on Neon Serverless Postgres:

Encryption at Rest All database storage volumes and automated snapshot archives are encrypted using AES-256 standard keys.

Connection Pooling & SSL Database connections require SSL (sslmode=require), preventing unencrypted transit between compute functions and databases.

We partner with Clerk to provide enterprise-grade identity and session lifecycle verification: - Mandatory Multi-Factor Authentication (MFA): All studio administrator and staff accounts require hardware-backed or authenticator-app MFA; - Role-Based Access Control (RBAC): Strict principle of least privilege ensuring developers access only the repositories and environments required for active projects; - Cryptographic Session Tokens: Short-lived JWTs with automated refresh rotation and server-side revocation.

For clients deploying artificial intelligence integrations, chatbots, or automated workflows:

Zero Public Model Training We exclusively route commercial requests through commercial enterprise endpoints (OpenAI API, Anthropic API, Google Cloud Vertex). Under these enterprise terms, customer inputs and completions are never utilized to train or fine-tune public models.

• Isolated Vector Embeddings: RAG vector embeddings are stored in tenant-isolated database tables;
• Prompt Injection Safeguards: Input sanitization and system-level guardrails to mitigate prompt injection exploits.

Every release shipped by AUX STUDIO passes through automated continuous integration (CI) security checks: - Automated vulnerability scanning of npm dependencies; - Strict TypeScript type-checking to eliminate runtime exceptions; - Zero secrets committed to code repositories (enforced with automated secret scanning).

Our client management and bespoke invoicing portals enforce secure parameterization: - No Card Data Stored: Payment transactions are handled via RBI-regulated gateways with PCI-DSS compliance; - Tamper-Proof Invoices: Digitally signed PDF invoices with immutable invoice hashes.

• Continuous backups with point-in-time recovery for all production databases;
• Encrypted off-site replication of critical data;
• A documented incident response process for containment, investigation, and notification where legally required.

AUX STUDIO deeply values the global security research community. If you discover a potential security vulnerability across our website or public web services, we encourage you to notify us promptly.

Researcher Guidelines - Give us reasonable time to investigate and resolve the issue before disclosing it publicly; - Do not access, modify, or download private customer data or client databases; - Do not perform destructive denial-of-service (DDoS) testing or spam our contact channels; - Operate in good faith and adhere to safe harbor principles.

If you conduct security research in compliance with these guidelines: - We will consider your research authorized and will not initiate legal action against you; - We will work cooperatively with you to understand and remediate the issue rapidly; - We will publicly credit your contribution on our security acknowledgments page upon request.

Please submit detailed vulnerability reports, proof-of-concept steps, and security inquiries directly to: - Security Desk: AUX STUDIO - Attn: Security Team - Response Window: We aim to acknowledge every report within two (2) business days.