Security

Your data is protected with enterprise-grade security measures.

Encryption

All API traffic encrypted with TLS 1.3 in transit
BYOK (Bring Your Own Key) API keys encrypted at rest using AES-256-GCM
Passwords hashed with bcrypt (cost factor 12)
Encryption keys never logged or exposed in API responses

Authentication & Access

JWT-based authentication for all API requests
Token-based stateless sessions with secure httpOnly cookies
Role-based access control (user / admin)
Admin endpoints protected by additional adminAuth middleware

Infrastructure

Cloudflare CDN and DDoS protection at the edge
Application hosted on Railway cloud (isolated containers)
PostgreSQL database with encrypted connections
Redis for caching and rate limiting

API Security

Rate limiting per user and per endpoint to prevent abuse
Request validation and sanitization on all inputs
CORS configured with explicit origin whitelist
Helmet-style security headers on all responses
No credentials or secrets in client-side code

Data Protection

We do not sell, rent, or share your personal data with third parties
API keys are encrypted and only decrypted when needed for upstream calls
Usage logs retained for billing and debugging, not for tracking
Account deletion and data export available upon request

BYOK (Bring Your Own Key)

Your own API keys are encrypted with AES-256-GCM before storage
Keys are only decrypted in memory when forwarding requests to upstream providers
A unique master encryption key is required in production (BYOK_MASTER_KEY)
You can delete stored keys at any time from the dashboard

Compliance & Governance

Operated by ZEVCHEN AI LIMITED (Hong Kong SAR)
Privacy Policy and Terms of Service under HKSAR law
Dispute resolution via HKIAC arbitration
Transparent data processing with clear consent records

Reporting

If you discover a security vulnerability, please report it responsibly to hello@orvexaproject.com. We appreciate responsible disclosure and will work to resolve the issue promptly.