Security

How Apavin protects your accounts and your customers.

Written as a list of what the code does, so you can check it against your own requirements. Questions, or a security questionnaire to fill in: sales@apavin.com.

Connected accounts

  • Mailbox app passwords and WhatsApp access tokens are encrypted at rest with AES-256-GCM. The key lives in the hosting environment, not the database, and the app refuses to start in production with a missing or placeholder key.
  • No tool, API response or audit entry returns a credential. Agents see an account's label, address and health only.
  • Disconnecting an account deletes its stored credentials and keeps conversation history. App passwords can only be invalidated at the provider; the settings page says so.

AI agent access (Apavin MCP)

  • Apavin is its own OAuth 2.1 authorization server. Clients are public, PKCE with S256 is required, and redirect URIs must match what the client registered.
  • Access tokens are opaque, last one hour, and are stored only as SHA-256 hashes. Refresh tokens rotate on every use; presenting a used one revokes the whole connection.
  • Every token is bound to the MCP resource it was issued for and is refused anywhere else. Tokens from other services are never accepted.
  • Each call checks the token's scopes, the workspace's MCP permissions, the plan, and the authorizing member's current role and personal permissions. A demotion or removal takes effect on the next call.
  • Revoking a connection invalidates its tokens immediately and cancels any message it queued that has not been sent.

Outbound messages

  • Messages an agent submits wait for a person by default. Automatic sending exists only on plans that include it, only when an admin turns it on, only for replies in existing conversations, and never for templates, scheduled messages, new recipients or messages containing blocked terms. A kill switch stops it at once.
  • Every send carries an idempotency key, unique per workspace. Each approved message is claimed in one conditional database write before the provider is called, so racing approvals or a retried request cannot send it twice.
  • A send whose outcome is unknown is never retried automatically. It is shown as outcome unknown for a person to check.
  • WhatsApp free-form replies are refused outside Meta's 24 hour window, and every WhatsApp message is refused to a customer who sent STOP. Templates are checked against Meta before sending.

Tenant isolation

  • Every query is scoped to the workspace that issued the session or token, and to the accounts the plan allows. An id from another workspace returns not found, whether guessed or copied.
  • Automated tests create two workspaces and try to read, send in, cancel and approve across them.

Untrusted content

  • Customer messages and documents reach an agent in fields marked untrusted, with a notice that they are data, not instructions. Credential-shaped strings are masked.
  • No permission decision reads message content, so an instruction hidden in an email cannot change what the agent may do. The worst a fooled agent can produce is a draft waiting for a person.

Webhooks, limits and logs

  • Meta webhooks are rejected in production without a valid X-Hub-Signature-256. Inbound events and delivery receipts are deduplicated, so a redelivered webhook changes nothing.
  • MCP calls are rate limited per connection and per workspace, and metered against a monthly allowance enforced on the server.
  • Authorizations, permission changes, approvals, sends, failures and revocations are written to an append-only audit log, without message bodies.
  • Server errors are logged in full on the server and reported to clients as a generic message, never a stack trace.

What Apavin does not have yet

  • No SOC 2, ISO 27001 or similar certification. Apavin does not claim one.
  • No Gmail or Microsoft 365 OAuth connector: email uses IMAP and SMTP with app passwords.
  • Rate limits are held in memory per server instance; monthly quotas are held in the database and are exact.
  • No customer-managed encryption keys and no data residency choice beyond the hosting region.