Security

Signing in

• Your browser holds only a secure session cookie that scripts cannot read; the session itself lives on our server, stored hashed, and expires after inactivity and after a maximum lifetime.
• With Google or another sign-in provider, their tokens are used on our server and never reach your browser.
• Signing out ends the session on the server, not just in your browser.
• Repeated sign-in attempts and other sensitive actions are rate-limited.

Passwords

• At least 15 characters. Common passwords, and passwords that contain your email name or display name, are refused.
• Stored only as a salted, memory-hard hash — never in a readable form.
• A password-reset link is valid for 30 minutes, and setting a new password signs you out on every device.

The app

• Every change you make is checked against forged requests and against the site it came from.
• The app is served over HTTPS only, with headers that stop other sites from framing it.
• The AI assistant never runs a risky or destructive action without your explicit confirmation.
• Panels built by the AI panel builder never run scripts; real data is filled in only as plain text.

Keys and secrets

Your own AI API key stays in your browser's memory while the page is open and is never stored. The secrets the payment system needs are encrypted on our servers.

Payments

Navrya never holds your wallet's keys and will never ask for your private key or recovery phrase. Pay only the exact amount, to the address shown on the invoice inside the app.

Reporting a problem

Found a security issue? Open a ticket in Support under Technical with the details and how to reproduce it. Please don't access other people's data or disrupt the service while testing.