Security practices

The public AIOVIX website is served over HTTPS and uses security headers that restrict framing, mixed content, browser permissions, and unapproved content sources. Forms use server-side validation and abuse controls where appropriate.

Access to client systems is limited to the people and environments needed for the agreed work. We prefer named accounts, least-privilege permissions, separate development environments, and client-owned repositories and production accounts where practical.

API keys, database credentials, and deployment secrets should be stored in approved environment or secret-management systems rather than committed to source control. Production data access is scoped to the engagement and avoided when representative test data is sufficient.

Security requirements vary by product, but common controls considered during delivery include:

If you believe you found a security issue affecting an AIOVIX-owned public system, email hello@aiovix.com with the affected URL, a clear description, and safe reproduction steps. Do not access, alter, download, or disclose data that does not belong to you.

This page describes general practices, not a certification or a guarantee that every client system uses identical controls. Security scope, compliance obligations, testing, incident handling, and support commitments are documented separately for each engagement.