How Aivastark protects your data
A plain summary of how Aivastark handles your data, what it doesn't have yet, and how to report a concern. No badges we haven't earned.
Last reviewed 2026-10-07
Your customer writes
In your website widget, or on WhatsApp, Instagram, Messenger or Telegram.
Encrypted in transit
The message reaches Aivastark over TLS.
Your knowledge only
The agent searches your organisation's knowledge base, isolated by row-level security.
AI model provider
The conversation and the relevant passages go to a model provider, mostly through OpenRouter. No training on your data.
Your inbox
The answer and the conversation are stored for your team, on AWS in Tokyo.
How does Aivastark protect customer data?
Aivastark encrypts connections with TLS and data at rest through its database provider, isolates each organisation's knowledge base and conversations with row-level security, and doesn't train or fine-tune AI models on your content. Data is stored in Aivastark's managed Supabase database on AWS in Tokyo, and a GDPR Data Processing Agreement is included on every plan. Messages reach the AI model as written, and there is no third-party certification or single sign-on yet.
What protects your data today
Encrypted in transit
TLS on every connection to Aivastark's site, dashboard, widget and APIs.
Encrypted at rest
AES-256, by our database provider. Passwords are stored hashed by Supabase Auth.
Isolated per organisation
Your knowledge base, embeddings and conversations are kept apart from every other customer's with row-level security.
Not used for training
Aivastark doesn't train or fine-tune AI models on your content. The main answer model is routed only to providers that don't collect prompts for training.
Stored in Tokyo
Aivastark's managed Supabase database runs on AWS in Tokyo (ap-northeast-1).
Admin access behind MFA
Aivastark's internal admin panel requires multi-factor authentication, and administrative actions are recorded in audit logs.
Your team, your rules
Owner, admin and member roles, per-member section access, and a team activity log you can export.
GDPR DPA on every plan
An Article 28 Data Processing Agreement is included on every plan, Free included.
What we don't have yet
Security pages tend to list only strengths. These are the gaps, so you can decide with the whole picture rather than find them during procurement.
No third-party certification
Aivastark hasn't completed a third-party security audit or certification.
No redaction before the model
Messages reach the AI model as the customer wrote them. Ask customers not to share card numbers, passwords or health details in chat.
No Business Associate Agreements
Aivastark doesn't sign BAAs, so don't use it to collect protected health information.
No single sign-on
Team members sign in with email and password or with Google.
No scheduled purge of conversations
Conversations stay until you delete them. Delete a conversation or a visitor's data yourself, any time.
If your procurement process needs something specific, email support@aivastark.com and we'll tell you plainly where we stand.
You stay in control of it
Your content and your customers' conversations belong to you. Delete or export them whenever you need to, and switch visitor analytics off if you don't want it.
Delete any time
Delete a conversation or a visitor's data from the dashboard whenever you need to.
Export any time
Export conversations as CSV, including before you cancel.
Visitor analytics without cookies
The widget sets no cookies. Visitor Lenz collects page views, referrers, device and approximate location, using the visitor's IP address for the location, and can be switched off per widget.
Analytics that age out
Visitor-analytics events are kept for 90 days, page views for 180 days and sessions for 400 days. Conversations are not affected.
Report a vulnerability
We welcome responsible security research. Email your findings to security@aivastark.com with reproduction steps, and please don't disclose publicly before we've had a reasonable chance to fix the issue. The canonical contact and policy are published in our security.txt.
Security questions
Does Aivastark hold a security certification?
Not yet. Aivastark hasn't completed a third-party security audit or certification. What we do today: connections to Aivastark are encrypted with TLS and data is encrypted at rest, each organisation's data is isolated with row-level security, Aivastark doesn't train or fine-tune AI models on your content, and a GDPR Data Processing Agreement is included on every plan.
Where is my customer data stored?
Your knowledge base, embeddings and conversations are stored in Aivastark's managed Supabase database, hosted on AWS in Tokyo (ap-northeast-1), and isolated to your organisation by row-level security. To answer a question, the conversation and the relevant knowledge passages are sent to the AI model providers listed on the sub-processors page.
Is personal data removed before it reaches the AI model?
No. Messages reach the AI model as the customer wrote them. Ask customers not to share card numbers, passwords or health details in chat, and use your agent's instructions to tell it never to ask for them.
Can I use Aivastark with patient health information?
No. Aivastark doesn't sign Business Associate Agreements, so don't use it to collect protected health information. It handles general questions well, such as services, opening hours, insurance accepted and booking requests, without asking for medical details.
Does Aivastark support SSO?
Not today. Team members sign in with email and password or with Google, and you choose each member's role and which sections they can open.
Can I delete or export my data?
Yes. Delete a conversation or a visitor's data from the dashboard at any time, and export conversations as CSV whenever you need them, including before you cancel. Conversations are kept until you delete them; there is no scheduled purge.
Does Aivastark use my data to train AI models?
No. Aivastark doesn't train or fine-tune AI models on your knowledge base or conversations, and the main answer model is routed only to providers that don't collect prompts for training. The providers involved are listed on the sub-processors page.
How do I report a security vulnerability?
Email findings to security@aivastark.com with reproduction steps, and please don't publicly disclose before we've had a reasonable chance to remediate. Our canonical contact and policy are published at /.well-known/security.txt.