Security
Security and responsible access
Security claims should be specific and verifiable. AVAL describes the controls present in the service without implying certifications or guarantees that have not been established.
- Last reviewed
Account and workspace access
The client workspace uses authenticated sessions and server-side authorization checks. Access to project and engagement records is scoped to the authenticated user and applicable firm relationships. Public search indexing is not used as a security control.
Reports and shared material
Private report and file routes enforce access checks. Where a share link is created, the link token acts as a credential and should be handled accordingly. Access can be governed separately from the public marketing site.
Data handling
The application validates inputs at server boundaries, uses parameterized database access through the project data layer, and keeps sensitive operations on the server. Deployed traffic is expected to use HTTPS, and baseline response headers reduce common browser risks.
No public statement on this page should be read as a claim of SOC 2, ISO 27001, or another independent certification unless that status is separately verified and published.
Report a concern
Do not include credentials, private keys, or client records in an initial security report. Use the contact path to request a secure follow-up channel and provide a concise description of the issue and affected surface.
Continue exploring
Related guidance and services
Bring the question into focus.
Share the purpose, date, and company context to begin a practical scope discussion.