Security

How Aver is designed, and how to reach us about a vulnerability.

No patient data, by design

Aver validates pipelines against public reference materials (GIAB, SEQC2, GeT-RM Coriell cell lines). No endpoint accepts patient data: uploads whose sample names do not match a registered public reference material are rejected server-side before anything is stored, vendor configuration files are scrubbed of identifier-bearing fields on the customer's machine before upload, and the CLI and Runner transmit metrics and metadata only — reads, VCFs and reports never leave your environment.

Tenancy and access

• Every tenant table is protected by database row-level security scoped to your organisation; authorization is enforced on the server, not in the browser.
• Roles gate regulated actions: promoting a baseline, waiving drift, setting QC control limits and signing evidence require Approver or Owner, plus a written justification recorded verbatim in the audit log.
• Sign-in supports TOTP two-factor authentication; signing evidence requires re-authentication at the moment of signature.
• API keys are shown once, stored hashed, and revocable. Runner tokens are per-runner, org-scoped and revocable from the UI.

Integrity you can check yourself

• The audit log is append-only and hash-chained; chain verification runs on a schedule and on demand from the product.
• Evidence packs are deterministic: the same inputs produce a byte-identical document, and Verify recomputes the content hash against the stored record. The open-source CLI's aver verify does the same for local reports, so verification does not require trusting us.
• Reference data is pinned by version and SHA-256 checksum; comparison tools run from container images pinned by digest.

Platform

• Encryption in transit (TLS 1.2+) and at rest on all stores.
• Read-only source integrations: Aver never requests write scope on your repositories or registries.
• Dependencies are locked and pinned across Python, Node and Go; CI runs secret scanning and the build provenance of the aver-bio package is published on PyPI.
• Staging and production are separate environments with separate credentials.

Reporting a vulnerability

Email [email protected] with "Security report" in the subject. We acknowledge within 2 business days, keep you informed, and credit reporters who wish it. Please do not access data that is not yours; use a test account. Machine-readable contact: security.txt.