Security
How we protect your store
Sevra hosts your brain as plain markdown files. This page says exactly what protects those files today. Sevra is in early access, and we describe what exists, not a roadmap.
Last updated: July 2, 2026. This page describes the current Sevra product and is periodically reviewed and updated.
Architecture
Two separate planes
Account and billing data live in the application. Your store contents live in object storage. Your AI agent sits outside both, running under your own subscription with your AI provider.
Sevra platform
Application and account
- Authentication (WorkOS)
- Billing (Stripe)
- Application data (Neon Postgres)
- Application hosting (Vercel)
- Transactional email (Resend)
Your store
Your data, in the open format
- Plain markdown files
- The open db.md format (Apache-2.0)
- Object storage (AWS S3, migrating to Cloudflare R2)
- Encrypted at rest by the storage provider
- Full export at any time
- Deletion on request
- Self-hostable, always
Encryption
Encrypted in transit and at rest
In transit
All connections use TLS: your browser to Sevra, Sevra to its providers, and every read and write to your hosted store.
Store contents at rest
Store contents live in object storage and are encrypted at rest by the storage provider, AWS S3 today. We are migrating store contents to Cloudflare R2, which also encrypts at rest.
Application data at rest
Account and application data live in Neon Postgres, which encrypts data at rest.
Payment data
Payments are processed by Stripe. Card details go to Stripe directly and never touch Sevra's servers.
Authentication
Managed sign-in, no passwords held
Sign-in
WorkOS AuthKit handles sign-in. Supports email, Google, and enterprise SSO providers. Sevra does not store passwords.
Sessions
Sessions are managed through WorkOS AuthKit and checked on every request to the application.
No customer API keys
Sevra never holds your AI provider API keys. Your agent runs under your own AI subscription, and its credentials stay with you.
Practices
How we run the platform
Secret hygiene
Production credentials live in the deployment platform's encrypted environment store, not in code. The most sensitive values are write-only: readable by the running application, not by people browsing a dashboard.
Private code, open format
The platform codebase is a private repository with access limited to the team. The db.md format itself is the opposite: public, Apache-2.0, and designed to be readable without us.
Managed providers
Authentication, billing, hosting, database, and email run on established managed providers rather than systems we build and patch ourselves. Fewer custom systems means fewer places to get security wrong.
Infrastructure
Where things run
Application
The Sevra application runs on Vercel, hosted in the United States.
Application data
Account and application data live in Neon Postgres. Store contents do not live in this database.
Store contents
Hosted stores live in object storage: AWS S3 today, migrating to Cloudflare R2.
No machines, no keys
Sevra runs no customer VMs or dedicated machines and holds no customer API keys. Less standing surface, less to defend.
Status
Where security stands
Sevra is in early access. A formal third-party security audit has not yet been performed, and we do not claim certifications we do not hold. Here is the plain state of things.
In place today
TLS on every connection. Encryption at rest through the storage providers. WorkOS-managed sign-in. Stripe-handled payments. Secrets kept out of the codebase.
Not done yet
No formal third-party security audit has been performed. We hold no SOC 2 report and no penetration test on file. When that changes, this page will say so.
Never held
Your AI provider API keys. Your card details. Your passwords. None of these touch Sevra's servers.
Ownership is a security property
Your store is plain files in an open format. You can export everything at any time and host it anywhere. Whatever happens to Sevra, your data stays readable.
Deletion
Delete your store or your account and hosted contents are deleted. Deletion on request is always available: privacy@sevrahq.com.
We would rather understate this page than decorate it. Formal review comes as the product matures. Until then, this page states what exists.
Data processing
Sevra is operated by VibeCraft Inc. We act as a data controller for account and billing data, and we process your store contents on your behalf in order to host, index, and organize them.
Sub-processors: WorkOS (authentication), Stripe (billing), Vercel (application hosting), Neon (application database), AWS (object storage for store contents, migrating to Cloudflare R2), Resend (transactional email).
A data processing agreement is available on request: legal@sevrahq.com.
Incident response
If a security incident affects your account or your store, we notify affected customers promptly, within 72 hours of confirming the incident. Incidents are documented and reviewed.
Contact
Security questions and responsible disclosure: security@sevrahq.com. If you find a vulnerability, tell us there first. We read and answer every report.
See also: Privacy policy · Terms of service