Security at Avanis AI
Institutional teams hand us the workflows their decisions run on. This page describes plainly how we handle data, both on this website and inside client engagements, and what is on our compliance roadmap. Questions or security questionnaires: yash@avanisai.com (we complete questionnaires under NDA).
1. Two different scopes
This website is a marketing site. It collects what you type into its forms, plus usage analytics and error monitoring (Google Analytics, Microsoft Clarity and Sentry, described in our Privacy Policy). Analytics use cookies. Client engagements are governed separately, by contract and NDA, and typically involve far stricter controls described below. Nothing you browse here requires an account.
2. Data this website handles
Contact and waitlist forms collect the name, email, firm and message you submit. Submissions are sent over HTTPS to our own server function and stored in Airtable. Analytics are used in aggregate (pages viewed, approximate location, device class) and we do not use them to identify you individually.
3. Client engagements: where your data lives
Today, every deployment, ours and every client's, runs in the managed cloud environment described below (see sub-processors). A private-cloud or fully on-premises build is on request and scoped to the client's infrastructure; as of this writing none has shipped, and we say so here rather than let a due-diligence conversation find out first. We work NDA-first and never use client data to train models. Model calls pass through a gateway that strips position sizes and trade intent before a request leaves our systems. We are working toward zero-retention agreements with our model providers, and we share the current provider list and their data terms under NDA.
4. Encryption
All traffic to this website and to hosted deployments is encrypted in transit with TLS 1.2 or higher. Data at rest on our hosting and code infrastructure is encrypted by the underlying providers (see sub-processors below). For client deployments, encryption standards follow the client's infrastructure requirements and are agreed before any data moves.
5. Access control
Source code lives in private repositories with two-factor authentication enforced. Access follows least privilege; today Avanis AI is deliberately small, which means the access list is short and auditable. Client environments are accessed only with named, client-granted credentials, never shared accounts.
6. Sub-processors
Website: Vercel (hosting, form handling and analytics), GitHub (private code hosting), Airtable (storage of form submissions), and Google Analytics, Microsoft Clarity and Sentry (analytics, session recording and error monitoring, described in our Privacy Policy). Platform: Railway and Vercel (hosting) and Clerk (sign-in). Model providers are disclosed under NDA. Client engagements use a sub-processor list agreed per contract; for local-first deployments the list can be zero.
7. Retention and deletion
Form submissions are retained as ordinary business correspondence. You may request deletion of your personal data at any time by emailing yash@avanisai.com; we action requests within 30 days. Engagement data retention is defined by contract, with return-or-destroy terms at engagement end.
8. Compliance roadmap
We are honest about where we are: Avanis AI is an early-stage company and does not yet hold a SOC 2 attestation. SOC 2 readiness is on our near-term roadmap as client engagements formalize, and our engineering practices, private infrastructure, least-privilege access to that infrastructure, and audit trails in the product, are built so that certification is a documentation exercise, not a re-architecture. In the meantime we support client due diligence directly: questionnaires, architecture walkthroughs, and data-flow diagrams under NDA.
Hong Kong's SFC GenAI Circular (Nov 2024) sets requirements for firms using AI in high-risk activities like investment research: human-in-the-loop review before AI output is treated as final, model validation against source documents, confidence scoring, audit logging, and vendor risk tiering. We're building Avanis AI's compliance architecture around those requirements now: a data-classification and redaction layer between any client and any model vendor, an audit log of every model call, deployment options up to fully on-prem for clients who need it. This work is in progress, not complete, and we intend to have a Hong Kong compliance lawyer review the design before it becomes load-bearing for any client engagement.
9. Reporting a vulnerability
If you believe you have found a security issue on this website or in our software, email yash@avanisai.com with the details. We acknowledge reports within 48 hours and will not pursue good-faith researchers.