Security
This page describes, in plain language, how Volana protects your data. If you have a question that isn't answered here, contact security@volana.app.
Encryption in Transit
All traffic between your browser or device and Volana is encrypted using TLS (HTTPS). This applies to every page and API request, so data can't be read or altered while it travels over the network.
Encryption at Rest
Your data is stored on infrastructure that provides encryption at rest. On top of that, the OAuth tokens for the services you connect, including your Google Calendar, Zoom, and the app integrations (ClickUp, Asana, Linear, GitHub, Slack, and Notion), are additionally encrypted at the application layer using AES-256-GCM before they're written to our database. Access tokens for all connected services are never returned to the browser and are never written to logs.
Per-User Data Isolation
Volana's database uses Postgres row-level security (RLS) to enforce, at the database layer, that each user can only access their own data. This isolation holds even if there were a bug in application-level code, since the database itself rejects access to rows that don't belong to the requesting user.
Authentication
Sign-in is handled by Supabase Auth, supporting Google OAuth and optional email and password sign-in. We apply bot protection on signup to help prevent automated abuse of the platform.
AI Data Handling
Content you send to Volana's AI assistant, Luna, is processed by a small set of established third-party AI providers under their respective API terms. Per those terms, content sent through their commercial APIs is not used to train their general-purpose models. The current providers are listed on our Subprocessors page; see our Privacy Policy for more detail on how AI processing works.
Responsible Disclosure
We welcome reports from security researchers who find a vulnerability in Volana. See our vulnerability disclosure page for how to report an issue, and our machine-readable policy at /.well-known/security.txt.
A Note on Limits
No system is 100% secure, and Volana is no exception. We work to follow good security practices and to respond quickly to reports, but we can't guarantee the absence of every possible vulnerability. If you find one, please tell us.