Security at Nyrav

Hosting and encryption

• Nyrav runs on Cloudflare's network, and its database and logins are on Supabase (Postgres).
• All traffic uses HTTPS (TLS). Data is encrypted at rest by our hosting providers.
• Connection keys for WordPress, Shopify, Google and email are encrypted again by Nyrav with AES-256-GCM before they are stored.
• Requests from Nyrav to the WordPress plugin are signed (HMAC-SHA256) and expire after a few minutes, so they can't be replayed or faked.

Access control

• Every workspace is separated at the database level (row-level security): one customer can never read another's data.
• Roles: Owner, Editor and Viewer. Viewers can't change anything.
• Single sign-on with Google Workspace, Microsoft or SAML (Okta, Entra ID, OneLogin and others), and the option to require it for your email domain.
• API keys are shown once and stored only as a hash. You can revoke them at any time.

Changes to your websites

• Nothing is published until someone approves it, unless you turn on auto-approve for a type of change. Enterprise accounts can require two people to approve.
• Nyrav never deletes pages, changes themes or plugins, or hides pages from Google as a fix.
• Every change is recorded with what it was before, and can be undone from Nyrav or from the WordPress plugin, which can also pause all Nyrav changes in one click.
• Published pages are checked a few minutes after a change, and Nyrav undoes the change automatically if the page stops loading.

Audit and monitoring

• An audit log records approvals, publishing, settings and team changes with who did it and when. Enterprise accounts can export it.
• Unusual activity, such as outreach failures or sudden volume, raises an alert for our team.

Your data

• You can download your data at any time, and ask us to delete it.
• We don't sell your data or use it to train AI models.
• AI providers receive only what's needed to write a draft or check an AI answer (page text, keywords, questions), not your account details.

Providers we use