Security Overview
Last updated
We’ve built Abni to be secure by design. This page describes the technical and organisational measures we use to protect the platform and your data. We aim to be clear about what we do — and honest about what we’re still improving.
Infrastructure
- Abni is hosted on AWS in the EU — the eu-north-1 (Stockholm) region.
- The platform is built entirely on managed, serverless AWS services for compute, storage, database and content delivery. We do not run or patch our own servers.
- Development and production are fully separated environments, with their own storage, databases and secrets.
Encryption
In transit
- All traffic to the platform is encrypted with TLS (HTTPS). Plain HTTP requests are redirected to HTTPS, and our public API requires TLS 1.2 or higher.
- Calls to our third-party providers — AI providers and Stripe — are all made over HTTPS.
At rest
- Data stored in the platform — uploaded content, generated outputs, application data and logs — is encrypted at rest using AWS-managed encryption.
Secrets and credentials
- API keys, signing secrets and provider credentials are stored in AWS Systems Manager Parameter Store, encrypted with AWS KMS.
- Access to each secret is scoped so that only the services that need it can read it.
- Secrets are never committed to source code.
Access
Your account
- Passwordless sign-in via a single-use email link
- Session cookies are HTTP-only and scoped to your workspace
API access
- Every API endpoint requires authentication, apart from a public health check.
- API keys are validated on every request and can be revoked at any time.
- Payment webhooks are signature-verified before they are processed.
Internal access
- Access to infrastructure and production data is restricted to authorised operators, on a least-privilege basis.
- Multi-factor authentication is required on operational accounts, with credentials held in a password manager.
- Devices used for operational work must be secured — screen lock and full-disk encryption. If a device is lost, it is remotely locked or wiped and any potentially exposed credentials are rotated.
Your content and AI processing
- We do not train AI models — ours or any third party’s — on your data.
- Zero Data Retention is configured with Google Cloud, our primary AI provider, so prompts, uploaded images and generated outputs it processes for us are not retained.
- Section 5 of our Privacy Policy lists every AI provider we use and what each retains.
Monitoring
- System logging and metrics across the platform
- Usage tracked per client
- Failure alerts on the generation pipeline, with broader monitoring being extended
Third parties
We work with established providers:
- AWS — hosting and infrastructure
- Stripe — billing and payments
- Google Cloud, Anthropic, KIE.ai, FAL.ai — AI processing
We assess providers before use — security posture, data-processing terms, retention and processing location — and keep the list under review. Our Privacy Policy and Data Processing Agreement cover data sharing and international transfer safeguards.
Resilience
- Application data and stored content are held in AWS services that replicate across multiple availability zones within the region.
- Point-in-time recovery is enabled on the production database, with a 35-day recovery window.
- Versioning is enabled on the asset storage bucket, so overwritten or deleted files can be restored.
- These backups are live; restore testing is scheduled but has not yet been exercised — see “Ongoing improvements” below.
Data retention and deletion
We keep data only as long as needed to provide the service. Deletion uses a staged process — disable, short grace period, then permanent deletion. Section 9 of our Privacy Policy sets out the full retention and deletion process, and you can request deletion at any time via privacy@abni.ai.
Ongoing improvements
We continuously improve security. Current priorities include:
- Enhanced logging and audit controls
- Restore testing of our backups
- Credential rotation
We run regular internal security reviews covering access rights, credentials, providers and outstanding security actions.
Certifications
We do not currently hold formal security certifications such as SOC 2 or ISO 27001. We’d rather say that plainly than imply otherwise.
Incident & Breach Commitment
If something goes wrong, we act quickly and transparently. We maintain an internal incident-response and data-breach procedure that covers detection, severity triage, containment, notification and post-incident review.
What we do
- Record when we became aware and assign an incident owner
- Investigate immediately and preserve relevant logs
- Contain the issue — for example revoking keys, rotating secrets or disabling affected access
- Assess impact and severity
- Notify affected clients where required
If personal data is involved
We will:
- Notify affected clients without undue delay
- Where we act as processor, notify the client (as controller) without undue delay so they can meet their own obligations
- Where legally required, notify the ICO within 72 hours of becoming aware of a reportable breach
- Support any required reporting and meet our regulatory obligations
Our approach
- Clear ownership
- Fast response
- Honest communication
- A blameless post-incident review, with follow-up actions tracked to completion
Responsible disclosure
If you’ve found a security issue, email security@abni.ai. Our security.txt sets out the canonical contact and policy URL.