Security
ARIA holds your content and your visitors' questions. Here's how it's protected, and how to tell us if we've got something wrong.
Reporting a vulnerability
Email hello@qedcode.io with "security" in the subject. We'll acknowledge within two working days and keep you posted until it's closed. Please give us a reasonable window before disclosing publicly; we won't pursue researchers who act in good faith and don't degrade the service or access others' data.
How it's built
- Isolation by domain. An assistant only ever answers from the domain it belongs to, and the embed can only be framed by the DNS-verified domain itself.
- Verified ownership. No domain is crawled until a DNS record proves control of it.
- Least data. We fetch public pages. We don't ask for credentials to your site and can't sign in to it.
- No card data. Payments go through Stripe's hosted checkout; card numbers never reach our servers.
- Encrypted in transit. TLS everywhere, with HTTPS enforced.
How it's operated
- Dependencies are scanned continuously and patched on a schedule.
- Container images are pinned by digest, and the runtime image carries no build tooling.
- Secrets live in a managed secret store, never in the repository.
- Every change passes lint, type checking and the test suite before it can deploy.
Crawler
Our crawler identifies itself as ARIA-Crawler and publishes its addresses at crawler-ips.txt so you can allowlist it with confidence. Policy details are on the crawler page.