This page is maintained by Aware AI to answer common security and privacy questions about Aware. It describes controls that are currently in place — it is not an independent certification and does not assert compliance with any specific regulation.
Sign-in is offered via email/password and Google. Privileged areas (admin tooling and sensitive actions like billing or data export) require a second factor (TOTP) before they unlock. Sessions are managed by our backend provider and can be revoked from the account settings page at any time.
All user-owned tables enforce row-level security so signed-in users can only read and write rows they own. Sensitive secret material (encrypted provider keys, OAuth tokens, booking-account emails) is restricted to server-side code and is not readable by client roles.
Third-party API keys and OAuth refresh tokens are stored server-side and accessed only by edge functions. Connector credentials proxied through the Lovable gateway are not exposed to the browser. We never log secret values.
When you make a document public via a share link, comments submitted by unauthenticated visitors flow through a server endpoint that validates the share token and sanitizes the submitted name and email before storage. Direct database inserts from anonymous users are blocked.
We collect the data you give us (account profile, chat history, files you upload, connected calendar and email metadata when you opt in) so the assistant can work on your behalf. We do not sell personal data. You can export or delete your account from Account → Privacy.
Aware runs on the Lovable Cloud platform and uses providers for AI inference, payments (Stripe), and transactional email. A current list of subprocessors and our retention policy is published in the legal library.
Aware AI is responsible for the application — its access rules, integrations, and how your data is used inside the product. Our hosting provider (Lovable Cloud) is responsible for the underlying platform: infrastructure, managed authentication, and database isolation. You are responsible for protecting your account credentials and choosing what you share with connected services.
Last reviewed: October 2026