Your data
How Aura handles your data
You are considering letting software listen to conversations with your customers. That deserves specifics, not adjectives. This page says what the system actually does, including the parts that are not finished.
Isolation is enforced by the database, not by our code
Most multi-customer software keeps tenants apart by adding a filter to every query. That works until one query forgets, and the failure is silent until it is a headline.
Aura does it a level lower. Every table that holds your data carries a Postgres row-level security policy keyed to your organisation, and the policies are set to force, meaning they apply even to the table’s owner. The application connects as a database role created specifically without the privilege to bypass row-level security. It is not that our code always remembers to filter; it is that the database will not return your neighbour’s rows to a query that asks for them.
A check runs over the schema and fails the build if any table carrying an organisation id is missing that protection, so the guarantee cannot quietly erode as the product grows.
Getting the recording off the phone
The Aura app uploads over TLS and nothing else. The release build ships a network policy that refuses plaintext HTTP outright, so a misconfigured network cannot downgrade it. Uploads go to storage through a short-lived signed URL issued for that one file.
The app can also encrypt recordings at rest on the handset itself (AES-256-GCM), which protects the file while it is sitting on the device waiting for signal. That setting is off by default and it is separate from the upload protection. We would rather tell you exactly which control does what than describe both as “end-to-end encryption”, which this is not.
Retention and erasure
Your organisation has a retention window. It is 90 days out of the box and it is yours to set. A scheduled job deletes calls past that window: recording, transcript and everything derived from them, without anyone having to remember.
You can also erase a single call on request. That removes the audio from object storage and cascades through the transcript, the AI output, the extracted fields, the projected lead and the CRM delivery log, then writes a cryptographically signed receipt into your audit log. The receipt is the evidence. It is what you show when someone asks you to prove a deletion happened.
One limit worth stating: if a lead was already delivered into your own CRM, that copy lives in your CRM and is yours to delete there. We log the delivery so you know where to look.
The audit log
Administrative actions against your data are recorded with who did it, what they did, what they did it to, when, and from which address. The log is scoped to your organisation by the same row-level security as everything else, so it is yours and only yours.
Who else touches your data, and where they run
Named, with regions, including the one that is not in India.
Swipe the table sideways to see every column.
| Sub-processor | What it does | Where it runs |
|---|---|---|
| Supabase (Postgres) | Your calls, transcripts, extracted fields, leads and audit log | ap-northeast-2 (Seoul), not India |
| Sarvam AI | Indic speech recognition and call analysis | India |
| Google (Gemini) | Call analysis where Sarvam is not the configured provider | Google's infrastructure for the Gemini API |
| Hostinger | The application and worker servers, and the object storage holding call recording audio | See your contract; region is set per deployment |
Our Postgres database currently runs in Seoul, not in India. If your organisation has a data-residency requirement, that matters and you should raise it before you sign anything. We are telling you here rather than waiting to be asked.
What we do not have
A security page that only lists strengths is not a security page.
- No SOC 2 or ISO 27001. We have not been audited against either, and we are not going to imply otherwise.
- No published uptime SLA. We do not yet measure availability well enough to promise a number, so we do not promise one.
- No single sign-on or SAML. Access is by email login with role-based permissions.
- The privacy policy and data processing agreement are in legal review and are not published yet. If you need a DPA before you start, tell us and we will tell you the honest timeline.
- Data residency in India is not available today. See the sub-processor table above.
If any of these is a blocker for your business, say so early. It is a better conversation than discovering it during procurement.
Advertising and tracking
Three third-party trackers, and they load for every visitor.
We use the Meta (Facebook) advertising pixel and Google Tag Manager to measure which of our advertisements bring people to this site, and to show advertisements to people who have visited. They tell Meta and Google that a browser visited a page here, and separately when someone books a call.
We also use Microsoft Clarity to record how visitors use this site — page views, clicks and scrolling, replayed as session recordings and aggregated into heatmaps. Clarity masks form input by default; we do not configure it to record what you type into the enquiry form.
None of these wait for your consent before loading. They start on every page view, for every visitor, as soon as the page is interactive. We do not ask first and there is no control on this site to opt out — Meta’s and Microsoft’s own controls, linked below, are the way to limit what each of them does with your data.
The Meta pixel and Google Tag Manager receive your IP address and a cookie identifier, and Meta may link those to a Facebook or Instagram account it already holds. Microsoft Clarity receives your IP address, browser and device details, and the masked interaction data described above. We do not send any of them your name, email address or phone number through these trackers. Meta’s controls are at facebook.com/adpreferences and Microsoft’s at clarity.microsoft.com.
Beyond that, there is no chat widget on this site, and our fonts are served from our own servers rather than Google’s. The one cookie we set ourselves carries step 1 of the enquiry form into step 2, lasts two hours, and is not used to track you.
Related
Recording a call is also a legal question, not only a technical one. See how call-recording consent works in India for what Aura enforces and what remains your responsibility.