How Semavora protects your account and workspace data. For what we collect and why, see the Privacy Policy.
Hosting and data location
The application, database and storage run on Amazon Web Services in the EU (Frankfurt, Germany). Our website and web interface are hosted by Hetzner in the EU.
Encryption
All traffic uses HTTPS. Stored data is encrypted at rest by our hosting provider.
Accounts and access
- Sign-in uses Amazon Cognito. We never see or store your password.
- Each workspace has roles (admin, editor, viewer), and every request is checked against your workspace membership, so workspaces are isolated from each other.
- Your sign-in session is kept in a secure, HTTP-only cookie for up to 30 days.
What audits access
Semavora only audits websites you prove you control with a DNS record. It reads public pages only, identifies itself as SemavoraAuditBot, respects robots.txt and never changes your website.
Payments
Lemon Squeezy, our Merchant of Record, processes payments. We never receive or store card numbers.
Service providers
We use Amazon Web Services (hosting, database, storage and email), Hetzner (website hosting), Cloudflare (DNS and network security), OpenAI (AI analysis of public page excerpts during audits, with no account or payment data) and Lemon Squeezy (payments). The Privacy Policy lists what each one processes.
Operations and backups
Our infrastructure is defined as code and reviewed before changes reach production. Production databases have point-in-time recovery and deletion protection, and alarms notify us of failures.
Compliance
Semavora does not hold a third-party certification such as SOC 2 or ISO 27001 yet. We handle personal data under the EU GDPR and Moroccan Law 09-08, as described in our Privacy Policy. A data processing agreement is available on request.
Report a vulnerability
Email support@semavora.com with “Security” in the subject. Please give us reasonable time to fix an issue before sharing it publicly. We reply within one business day.