Security
Your AI, your keys,
your data.
Niyra is a personal AI agent — not a research lab dataset. We don't train on your conversations. Your keys are encrypted. Your chats are yours.
BYOK keys encrypted at rest
Your provider keys are AES-256-GCM encrypted with a separate key in Fly secrets. Decrypted only inside the request handler. Never logged, never returned, never used for anyone else.
Your chats stay yours
Conversation history is scoped to your user ID. Staff don't read your chats. Support requests ask you to share specific snippets — we never silently inspect.
OAuth-first integrations
55+ Composio integrations use OAuth, never raw passwords. Tokens auto-refresh proactively. Revoke any integration in one click — Niyra drops the token immediately.
Tool risk classification
Every tool tagged: read-only, modify, destructive, irreversible. Destructive actions ask for confirmation. Irreversible actions (delete data, send money) require explicit user approval each time.
Responsible disclosure
Found a vulnerability? Email security@niyra.ai or see /.well-known/security.txt. We respond in 48 hours, credit reporters, and never threaten legitimate researchers.
Infrastructure
TLS 1.3 in transit. PostgreSQL with row-level security on Supabase. Compute on Fly.io. No data in the EU yet — note if that's a blocker.
Security FAQ
- How are my LLM provider keys stored if I use BYOK?
- AES-256-GCM encryption at rest. Keys are decrypted only inside the AgentService request handler, never logged, never returned over the API, and never exposed to other users. The encryption key itself lives in Fly secrets, separate from the database.
- Who can see my chats?
- Only you. Niyra's backend stores conversation history scoped to your user ID; Avuvo staff don't read your chats. If you contact support, we don't auto-read your conversation — we ask you to share specific snippets you want us to debug.
- Where is my data hosted?
- Primary: PostgreSQL on Supabase (US-East). Compute on Fly.io. Vector memory in pgvector. Email outbound via Resend. Voice via ElevenLabs/Deepgram. Composio for integrations. All in transit over TLS 1.3.
- Does Niyra train on my data?
- No. We don't fine-tune models on user data. Memories you save are scoped to your account for retrieval only. LLM providers (Anthropic, OpenAI) have their own data-handling policies — we use Anthropic's enterprise terms when available.
- What if I find a security vulnerability?
- Report responsibly to security@niyra.ai. See https://niyra.ai/.well-known/security.txt for full disclosure policy. We respond within 48 hours and credit reporters on our hall of fame.
- Can I delete my data?
- Yes. The Settings panel has a 'Delete everything' option that wipes conversations, memories, records, and credentials. The deletion completes within 30 days (some backups roll off on a delay). Account closure also disconnects all OAuth integrations.
- Is there an audit log?
- Yes for destructive actions. Tools tagged 'destructive' (delete event, archive email, send message) record an audit entry visible in Settings → Activity. Tool calls also log their inputs and outputs (visible to you, not us) for receipt-style review.
Hall of fame
Security researchers who responsibly disclosed issues to Niyra. We credit by name (with permission) or pseudonym.
(No reports yet. Want to be the first? Get in touch.)
Have a security question we haven't answered?
security@niyra.ai32+
Integrations
OAuth-first
5
Channels
Web, WhatsApp, Telegram, Discord, voice
100+
Native tools
Memory, voice, browser, automation
18
Skills
JIT-loaded per turn
Related reading
Trust
Data exports & deletion
Take everything, leave anytime. No hostage retention.
ReadFeature
Bring your own keys
Run on your vendor budget. AES-256 at rest.
ReadDocs
BYOK setup
Plug your key. Encrypted before it touches disk.
ReadDisclosure
Responsible disclosure
Found a vulnerability? 48-hour response. Hall of fame.
ReadLegal
Privacy policy
What we store, what we don't, and why.
ReadPricing
How credits work
Cost transparency. Every reply shows what it spent.
Read