Trust and control
Security explained without empty promises
Avenalia applies verifiable controls per capability and publishes only what it can demonstrate in the current version.
Reviewed on 5 August 2026
Public surface
The frontend publishes a health check without personal data, uses validated configuration, keeps secrets outside code and avoids recording personal information.
Isolation by design
In the application, each organisation's context comes from the session and permissions block access by default; requests, tasks, cache, files, records and exports remain separate.
Sensitive actions
Generating a draft is not signing, submitting or sending. External actions will retain server-verified permissions, evidence, audit and human approval.