Privacy policy

01What we collect

Information you give us. When you request a free security check or contact us, we collect your work email, your company name, the tools you tell us you use, and anything you write to us. When you book a call, Google Calendar collects your name, email and the time you choose.

Account information. When you use Averil, we collect the names, emails and roles of the people in your workspace, and the settings you choose.

Data from systems you connect. Averil reads the systems you connect, such as Slack, GitHub, AWS, Google Workspace, Railway and Supabase, to investigate security issues. Depending on what you connect, this can include code, configuration, logs, alerts, audit events, user and access lists, and Slack messages in channels Averil is added to.

Website data. Our hosting provider records standard request logs, such as IP address, browser type and the pages requested, to keep the site running and secure. The site stores your light or dark theme choice in your browser. We do not use advertising or analytics cookies.

02How we use it

We use your information to provide Averil: to investigate issues, explain what we found, prepare fixes, carry out the actions you approve, and keep a record of each case.

We also use it to reply to you, set up your account, keep the service secure, prevent abuse, and meet our legal obligations.

We never use your data to train AI models. Before any data reaches a model, we remove secrets such as keys and tokens.

03How Averil handles access to your systems

Each connection gets only the access its job needs. Averil changes something in your systems only after a person on your team approves that exact action.

Credentials are short-lived and held by a separate broker service, so the models that investigate never see them. Each customer has their own encryption keys.

04Slack

When you add Averil to Slack, we receive your workspace's name and ID, a bot token, the channel you picked, and the member list (names, emails, roles and whether an account is active). Sign in with Slack gives us your name and email. The bot token is stored encrypted and is never shown to the AI models.

Averil only receives messages from channels it is invited to, direct messages sent to it, and messages that mention it. Messages in channels are checked for secrets as they arrive; we keep only the secrets found, replaced by a fingerprint, and discard the rest of the message. Direct messages and mentions are kept, with secrets removed, in the case or conversation they belong to.

Slack also sends us some data we never use: a webhook URL for the channel you picked, which we do not read or store, and profile fields such as phone numbers and titles that come with the member list, which we discard. We never send email to addresses we get from Slack.

Removing Averil from your workspace revokes its Slack access at once. Your Slack data is then kept with the rest of your account until you delete it, as described below.

05AI models

Averil uses Claude models from Anthropic to investigate and write, and a model from OpenAI to check its conclusions. Both are called through their business APIs and process requests in the United States. Before anything reaches a model we remove secrets such as keys and tokens, and each request carries only one customer's data.

Under their API terms, Anthropic and OpenAI may not train their models on what we send them. They may keep requests for a limited time, up to 30 days, to detect abuse, and then delete them. We never use your data, including Slack messages, to train AI models.

Findings from AI models can be wrong. Averil shows the evidence behind what it says, so you can check it.

06Who we share it with

We do not sell your personal information.

We share data only with the service providers that help us run Averil, such as cloud hosting, AI models, workflow infrastructure and sign-in. They may only use it to provide their service to us. The current list is on our Trust page under Subprocessors.

We may also share information if the law requires it, to protect people or the service, or as part of a merger or sale of our business, in which case this policy continues to apply.

07Where your data is stored

Techsity is based in Canada. Our service providers may store and process data in Canada, the United States and other countries. Wherever it is processed, we protect it as this policy describes.

08How long we keep it

We keep your data while your account is active and for as long as we need it to provide Averil. To delete your account and its data, email averil@averil.ai; we delete your data and destroy your encryption keys within 30 days, except for records the law requires us to keep.

If you only requested a security check or contacted us, we keep your details for as long as we are in touch, and you can ask us to delete them at any time.

09Your rights

You can ask to see the personal information we hold about you, get a copy to take elsewhere, correct it, or delete it, and you can withdraw your consent where we rely on it. Email averil@averil.ai and we will respond within 30 days.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada. If you are in the European Economic Area or the United Kingdom, you also have the rights given by the GDPR, including the right to complain to your local data protection authority.

10Security

We encrypt data in transit and at rest, limit who on our team can access it, and log access. No system is perfectly secure. If you find a vulnerability, please email security@averil.ai.

11Children

Averil is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect information from children.

12Changes and contact

If we change this policy, we will update the date at the top. If a change is significant, we will tell customers by email or in Slack before it takes effect.

Questions about privacy? Email averil@averil.ai or write to Techsity Inc., Ontario, Canada.