Security & compliance

Network & infrastructure

All traffic reaches Aven through an encrypted edge (Cloudflare) over TLS 1.3; the origin server's IP is never exposed. The API and dashboard run on dedicated infrastructure, and the public API is the only attack surface — protected by managed WAF, edge rate limiting and bot mitigation.

Accounts & access

Every request is authenticated with a per-account key carrying explicit scopes. Administrative endpoints are gated separately. Wallets are isolated per account and funds are spent down per second against an append-only, double-entry ledger.

Payments

Card payments are handled by Stripe and never touch our servers. Webhooks are signature-verified and crediting is idempotent, so a payment can never be double-counted.

Billing

Every charge is metered per second against the append-only ledger and rolled into clear, itemized invoices in USD. You can reconcile any invoice line back to the underlying usage at any time — no bundled fees, no surprises. Any applicable taxes are shown on the invoice itself.

Reliability

A continuous reconciliation loop never trusts believed state: it detects and reaps orphaned instances and closes ghosts, so you are never billed for capacity you didn't order, and capacity you released is truly gone.

Found a security issue? Email [email protected].