Security
Last reviewed August 28, 2026
Wevora's security controls are still being verified against a route-by-route authorization, tenant-isolation, secrets, upload, cache, and audit-log matrix. Current access is a pre-production evaluation and is not authorized or supported for real financial or tax data. Use only test or synthetic data in every current environment.
Encryption
- In transit — the intended production deployment terminates TLS at the hosting edge. This is verified during deployment, not assumed from application code.
- Application-level encryption — Wevora includes AES-256-GCM helpers for Plaid access tokens and Vendor TINs. Production approval remains pending until legacy-data backfill and plaintext rejection are verified.
Access control
- Authenticated workflows resolve the active company from the server-side session and are being checked against a complete tenant-owned endpoint inventory.
- Owner, Admin, and Accountant roles exist. Deny-by-default action enforcement and the read-only Accountant boundary are release gates still in progress.
- Cross-tenant and role tests must pass for every assessed read, mutation, export, bulk operation, and background job before production approval.
Authentication
- Passwords hashed with bcrypt (12 rounds).
- JWT-based authenticated sessions.
- Production cookie settings, secret strength and rotation, CSRF/origin checks, and invitation-token behavior require release evidence.
Input validation
Some request boundaries use Zod schemas. Complete strict-schema coverage, unknown-field rejection, payload limits, and file magic-byte validation are required before production approval.
Rate limiting
Rate-limit helpers are present for selected endpoints. Production must fail closed when the shared limiter is unavailable; that behavior remains part of the release verification.
PII redaction in logs
Source-controlled error handling includes best-effort redaction for selected sensitive field names. This is not evidence of complete end-to-end redaction. Production approval requires canary scans across logs, errors, caches, analytics, snapshots, and test artifacts.
Audit log
Selected state-changing actions write AuditLogrecords. Complete append-only coverage with actor, tenant, request ID, target, timestamp, and redacted before/after values is a release gate and is not yet claimed as complete.
Third parties
See the Privacy page for the current integration inventory and its release qualifications. The presence of an integration does not establish that it is enabled or covered by verified contractual controls. Vendor contracts and production configuration require separate operational verification.
Reporting a vulnerability
Email security@usewevora.com. Reports are reviewed according to severity and available response capacity. No response-time or remediation SLA is currently offered. We do not currently run a paid bug-bounty program; responsible disclosure is appreciated.
Release gates in progress
- Complete role/action and tenant-boundary inventory.
- Secret, token, and TIN migration plus negative egress tests.
- Strict mutation, webhook, upload, and rate-limit validation.
- PII-safe logs, audit events, backup, restore, and incident-response evidence.