Permissions and your data
How Averil holds access to your systems, what it stores, what models see, and how to delete it all.
Least access, approved changes
Every connection starts read-only. Write access is a separate credential, limited to named actions, and off until you turn it on. Each write is a typed plan that a person approves, and it ends with a read-back of the live state.
No model enforces any of this. Permissions live in the broker, the executor and policy code. A model that was fully hijacked could only ask for things it was already allowed to have.
The broker and the executor
| Service | Holds | Never |
|---|---|---|
| Broker | Read access to your tools | Performs a write |
| Executor | Your opt-in write access | Acts without a valid approval for the exact action |
| Everything else, including the agents | No customer credentials | Calls your systems directly |
Each runs in its own AWS account. When an investigation starts, Averil issues a signed, short-lived token naming your workspace, the case and the reads that case type allows. The broker checks it, and the operation allowlist, on every call. The model never sees the token.
No long-lived keys
| Tool | How Averil gets in |
|---|---|
| Slack | OAuth bot token, stored encrypted by the broker |
| GitHub | GitHub App; the broker exchanges a signed request for short-lived installation tokens |
| AWS | A role you create that trusts only Averil's broker, with your ExternalId; sessions last at most an hour |
| Google Workspace | Domain-wide delegation; the key stays in a key service and tokens are short-lived |
| Supabase | OAuth, refreshed by the broker |
| Railway | Workspace token held by the broker |
The full list of operations is the access manifest. Every read and write is logged to your action log before it is sent.
Evidence and redaction
- Raw evidence is stored with its SHA-256 hash, and history is append-only.
- Evidence and model interpretation are kept apart. An inference never overwrites what your system returned.
- Secrets are removed before anything reaches a model, and are never shown in Slack. Averil requests secret names, never values.
- Logs, code, alerts and Slack messages are treated as untrusted data. A comment in your code cannot give Averil new instructions or permissions.
- The action log is hash-chained, with signed checkpoints stored under a write-once lock in a separate account.
Models and training
Averil never uses your data to train AI models. Model calls go through one gateway, which only uses models that passed Averil's evaluations for each role. See the privacy policy for details and subprocessors for the providers.
Your data and deleting it
Each customer's data is encrypted with its own keys. You can export every case and its evidence at any time, as signed packages your auditor can use. When you delete your account, your keys are destroyed, which makes the stored data unreadable, apart from records the law requires us to keep.
To delete your account or ask about your data, email averil@averil.ai. Read more on the Trust page.
Stuck? Email averil@averil.ai or ask me in Slack.