Skip to main content
We’re upgrading Seclum to RAVIONIX.

Security & trust

Every privacy claim should be testable.

Read the schema, read the extension source, capture the network traffic. These are architectural properties, not policy promises.

RAVIONIX is not currently SOC 2 or ISO 27001 certified, and no completed third-party attestation is implied. The Trust Center documents the current controls and certification roadmap.

  • Raw content is processed, not stored

    Raw URLs and messages are processed transiently to produce a verdict and are not stored in the RAVIONIX database. Analysis involves an AI provider. Only derived hashes, verdict data and required operational metadata are retained.

  • Passwords never leave the device

    Your browser hashes the password; we receive only the hash and send Have I Been Pwned just its first 5 characters. Only that 5-character prefix is kept.

  • No cloud keys held

    AWS scanning uses a customer-owned read-only role with a per-tenant ExternalId, assumed for fifteen minutes. No access keys are stored.

  • Immutable audit log

    Updates and deletes are blocked by a database trigger, with a two-year retention rotated on a schedule.

  • GDPR export and erasure

    Article 15 export and Article 17 erasure both run in seconds without support-ticket gating. CCPA and CPRA ride the same machinery.

  • PCI DSS SAQ A scope

    When paid plans launch, payments will be handled through a hosted provider flow designed to keep RAVIONIX eligible for PCI DSS SAQ A scope. Eligibility and the applicable annual assessment remain subject to verification.

Privacy built into the architecture

Architectural properties you can verify: read the schema, read the extension source.

  • Raw content is not storedProcessed to produce a verdict, then discarded — only hashes, verdicts and operational metadata are retained
  • Passwords never leave the deviceHashed in the browser, checked by k-anonymity
  • No AWS keys heldA customer-owned read-only role, assumed for 15 minutes
  • Every agent run recordedSchema-validated output; cached and non-reasoning checks skip the model entirely
  • GDPR export and eraseArticle 15 and 17 requests run in seconds
  • WCAG 2.2 AADesigned and tested against WCAG 2.2 AA to support applicable EAA and Section 508 requirements

These are current implementation properties. Where a control is planned rather than in place, the module and roadmap sections say so explicitly.