🌿

AURALEN

Data Security & Infrastructure Report

Prepared for legal/advisory review — April 5, 2026

Confidential

🛡️

Executive Summary

Auralen is a personal development assessment platform. Users answer questions about how they think and communicate, and receive an archetype profile report.

Auralen never stores passwords for OAuth users, never sees payment card numbers, never sells data, and uses industry-standard encryption at every layer. All infrastructure providers are SOC 2 Type II compliant.

📊

What Data We Collect

Data Type	Sensitivity	Where Stored
Name & Email	low	Supabase (encrypted)
Assessment Answers	medium	Browser only (temporary)
Archetype Scores	medium	Supabase (encrypted)
Shadow Patterns	high	Supabase (encrypted)
AI Chat Messages	high	Anthropic API (30-day retention)
Emoji Collection	low	Supabase (encrypted)
Payment Info	critical	PayPal ONLY (never touches our servers)

What we do NOT collect: IP addresses, browser fingerprints, location data, tracking cookies, analytics data, social media posts or contacts.

🏠

Infrastructure — Where Everything Lives

Supabase

Database

Location: AWS (us-east-1, Virginia)

Encryption: AES-256 at rest, TLS 1.2+ in transit

Compliance: SOC 2 Type II, HIPAA-eligible

Security documentation →

Vercel

Website Hosting

Location: Global Edge Network (AWS-backed)

Encryption: TLS 1.3, automatic SSL

Compliance: SOC 2 Type II

Security documentation →

PayPal

Payment Processing

Location: PayPal servers

Encryption: PCI DSS Level 1

Compliance: PCI DSS Level 1 (highest)

Security documentation →

Anthropic

AI Chat (Claude)

Location: Anthropic servers

Encryption: TLS 1.2+ in transit

Compliance: SOC 2 Type II

Security documentation →

GitHub

Source Code (private repo)

Location: GitHub servers

Encryption: Encrypted at rest

Compliance: SOC 2 Type II, FedRAMP

Security documentation →

Google/GitHub/Twitch/X

OAuth Login Providers

Location: Their servers

Encryption: OAuth 2.0 standard

Compliance: Each individually SOC 2 compliant

🔐

Authentication — How Logins Work

OAuth (Google, GitHub, Twitch, X)

User clicks “Sign in with Google” → redirected to Google’s login page → Google authenticates them → sends back name + email only → Auralen creates an account.

We never see their password. Each OAuth provider creates an independent, separate account. Same email on different providers = different accounts (privacy-first).

Manual Signup (Email + Password)

User creates username and password directly. Completely separate from OAuth accounts.

✅ Implemented: Passwords are hashed with bcrypt (10 salt rounds). Server-side verification via /api/auth. Legacy plaintext passwords auto-migrate on successful login.

🔄

Data Flow

Assessment Flow

User answers 25 questions in browser

Answers stored temporarily in browser (sessionStorage)

On completion: scores calculated → sent via HTTPS → saved to Supabase

Raw answers are NOT stored permanently — only calculated scores

AI Chat Flow

User types a question about their report

Archetype scores + question sent to Anthropic API via HTTPS

Anthropic returns AI response (not stored in our database)

Chat history exists only in browser session

OAuth Login Flow

User clicks “Sign in with Google”

Redirected to Google’s auth page (we never see the password)

Google sends auth code to our callback URL

Supabase exchanges code for session token

User account created/found by email + provider

✅

Security Measures

✅HTTPS everywhere (TLS 1.3)

✅Database encryption (AES-256)

✅No tracking cookies/analytics

✅OAuth via established providers

✅API keys in env vars (not in code)

✅Private GitHub repository

✅Owner portal behind password

✅Server-side maintenance mode

✅Payments handled by PayPal

✅Account separation by provider

❌Rate limiting on API routes

✅Password hashing (bcrypt)

✅Server-side login verification

✅Separate accounts per OAuth provider

✅Server-side maintenance mode

❌Email verification

❌GDPR data export/deletion

🧠

Psychological Data Considerations

Auralen is not a clinical psychological assessment. It is a personal development tool similar to MBTI, Enneagram, or StrengthsFinder. It does not diagnose conditions.

However, archetype scores and shadow pattern data describe behavioral and cognitive tendencies, which may be considered sensitive personal information under certain jurisdictions.

Questions for Legal Review:

Does storing archetype/shadow data trigger biometric or psychological data protection laws?
Should users explicitly consent beyond general Terms of Service?
If used in workplace/team settings, do employment laws apply?
Is the “not clinical advice” disclaimer sufficient?

👥

Who Has Access to What

Party	Access Scope
Jonathan (Owner)	Full access — database, hosting, code, API keys
Supabase	Database contents (infrastructure provider, per DPA)
Vercel	Application code + request logs (no persistent user data)
PayPal	Payment transactions only
Anthropic	Individual chat messages (30-day retention, not used for training)
OAuth Providers	Their own tokens only — cannot see Auralen user data
Other Users	Only what a user explicitly makes public (opt-in toggle)

🚀

Pre-Launch Security Checklist

✅

Implement bcrypt password hashing for manual signups

CRITICAL

⬜

Add rate limiting to all API endpoints

HIGH

⬜

Add email verification for manual signups

HIGH

⬜

Input sanitization audit across all endpoints

HIGH

⬜

GDPR compliance tools (data export, deletion)

MEDIUM

⬜

Session timeout / auto-logout

MEDIUM

⬜

Content Security Policy (CSP) headers

MEDIUM

⬜

Web Application Firewall (Vercel Pro)

LOW

⬜

Penetration testing by security firm

LOW

This report was prepared as a technical overview for advisory review.
It is not legal advice. A qualified attorney should review all privacy, security, and compliance matters before public launch.