Security

Audio Vault is designed so control traffic and audio bytes follow different paths with least privilege.

Account and Session Security

• Passwords use modern hashing (argon2id). Magic-link login uses time-limited tokens sent via transactional email.
• Optional TOTP multi-factor authentication.
• Sessions use rolling and idle timeouts. API rate limits reduce brute-force risk.

Tenant Isolation

Every catalog row and object key is scoped to your account. Automated tests verify that one customer cannot read another customer’s uploads or playback grants.

Storage and Transport

• Customer audio lives in a private S3-compatible bucket — not on the static website host.
• Upload and playback use short-lived presigned URLs; the API never ships storage credentials to the browser.
• TLS terminates at the edge for public hostnames. Original files are verified with SHA-256 at finalize.

Browser and Static Site

The marketing site and PWA shell on Cloudflare Pages serve HTML, CSS, and JavaScript only. No customer audio is stored or served from the apex domain.

Operations

Backups target 24h RPO and 4h RTO for catalog state. See backup and recovery for customer guidance.

Reporting Issues

Report security concerns, abuse, or privacy requests to support@audiovau.lt. Include Security, Abuse, or Privacy in the subject line as appropriate.