Security at Alterion Labs

The facts below describe how Alterion Labs keeps and protects data today.

Where your data is kept

Alterion Labs runs on Amazon Web Services in the United States.

The application, the database and file storage run on Amazon Web Services in the us-east-1 region (N. Virginia).
Every page that Alterion Labs renders sends the HSTS header, so browsers use HTTPS only.
The application connects to the database over TLS.
The database storage is encrypted at rest.
Access tokens for connected accounts are encrypted before they are stored.
The database is backed up automatically. Backups are kept for 7 days.
Calls to AI models on Amazon Bedrock run in United States regions.

Access to an account starts with a verified sign-in.

Sign-in at alterionlabs.com/login uses a one-time 6-digit code that Alterion Labs sends to your email address.
The code is stored only as a hash. It expires after 5 minutes and stops working after 5 wrong attempts.
The session cookie is signed. Scripts in the browser cannot read it.
Each staff tool request needs a staff sign-in and membership of a staff group.
API tokens for AI tools are securely hashed before they are stored.

The audit reads public pages only.

The audit fetches public files only: the homepage, robots.txt, sitemap.xml, llms.txt and the small set of files listed at /about/bot.
The audit crawler does not log in, submit forms, execute JavaScript, or follow links beyond those files.
The AI Content Marketing Agent reads a limited number of public pages of your site in one run, from your sitemap and internal links.
Both crawlers identify themselves as AlterionLabs/1.0 and honor a Disallow rule in robots.txt for AlterionLabs or *. Both crawlers always read /robots.txt, and the audit always reads the homepage of the site that you ask it to audit.
Each response is limited to 2 MB and each request to 10 seconds.
When you disconnect a connected account, Alterion Labs deletes its copy of the access tokens.

Send the report by email.

Last updated: 10 October 2026