Ravano security and your data

Data separation

Every business has its own data space, and the bot’s retrieval is always filtered by that business’s ID, so one business’s answers are never built from another business’s information. Automated tests check this behaviour.

Passwords and keys

• Connection credentials for your sources (such as your database or API) are stored encrypted.
• An API key is stored only as a hash (SHA-256) and cannot be shown again after creation.
• Passwords are stored with bcrypt, and common or weak passwords are rejected.

Sign-in and access

• Sign-in attempts are rate-limited, and an account is temporarily locked after repeated failures.
• Access tokens are short-lived and refresh tokens rotate.
• You can restrict the widget to your own domains, and a per-business request cap per minute applies.

Responsible crawling and inputs

• When crawling a site, robots.txt and rate limits are respected.
• To prevent SSRF, internal addresses and disallowed ports are blocked.
• Uploaded files are checked for type and size, and request bodies are size-capped.

Safety of AI answers

The bot is instructed to treat source content as data, not as instructions, and not to reveal its internal instructions. This reduces the risk of prompt injection but does not eliminate it, which is why reviewing information and reading conversations in the panel stays in your hands.

Limits we state openly

• Absolute security does not exist and we do not promise it.
• We hold no formal certification (such as SOC 2 or ISO 27001).
• To answer, parts of your information are sent to a language-model service; details are in the privacy policy.
• Widget restriction is based on the browser’s domain, and non-browser clients can forge it; the request cap and wallet balance limit that risk.

Report a vulnerability

Found something? Report it through the contact page.