Security

Last updated: 27 Oct 2026

In plain words

Data is stored on servers in Iran.
Keys are hashed and shown once; roles control access.
We hold no security certifications yet — and say so.

Report a vulnerabilityE-mail us. We acknowledge within one working day and credit reporters who want it.security@abrova.ir

1 Encryption#

TLS in transit; encrypted volumes at rest; secrets encrypted with AES-256-GCM; passwords hashed; API keys stored hashed and shown once; payment callbacks signature-checked.

2 Infrastructure#

Servers in Iranian data centres. [Wording from Abrova.]

3 Access control#

Organisations with roles Owner, Admin, Member and Viewer; the public key ab_live_… for apps and the server secret ab_srv_… for servers; allowed origins per project.

4 Data ownership#

Tenant isolation; we never sell data; export and deletion on request.

5 SDK supply chain#

SDK source on GitHub (Abrova-co); packages published to Abrova Center.

6 Payments#

Through an Iranian payment gateway. Abrova stores no card data.

7 Compliance#

[Wording from Abrova on Iranian data and e-commerce law.] We make no certification claims.

8 Incident response#

We notify affected customers within 72 hours and publish a report afterwards.

Questions about this page? Write to support@abrova.ir