Security at Wenora

Identity and account access

• Wenora uses Google OAuth for authentication and never receives or stores your Google password.
• Email accounts require address verification. Passwords are protected with salted scrypt hashes, and sign-in attempts are rate limited. Resetting a password invalidates previous password sessions.
• Sessions are tied to the authenticated account, and workspace data is associated with the account email or authorized institution.
• Protected project routes require an authenticated session before workspace data is returned.

Data in transit and application safeguards

• wenora.ai uses HTTPS to protect data while it travels between your browser and the service.
• Application, API, database, and background processing responsibilities are separated to reduce unnecessary exposure.
• Production application containers use restricted, read-only filesystems where practical.
• Uploaded files and project operations are checked against the authenticated user or authorized workspace context.

Operational safeguards

• We maintain backups and deployment rollback procedures to support service recovery.
• We monitor service health, review dependency vulnerabilities, and apply security updates based on risk.
• Administrative access is limited to operational needs and protected with access controls.
• Security events are investigated and handled according to their potential impact.

AI and service providers

Wenora may send the content needed to perform a requested task to contracted infrastructure or AI service providers. We limit this processing to operating the service and apply contractual and technical controls appropriate to the provider and use case. More detail is available in our Privacy Policy.

Your role in protecting research

• Protect access to the Google account used to sign in.
• Sign out on shared devices and promptly report unexpected access.
• Upload only material you are authorized to process and remove unnecessary personal or confidential information.
• Do not upload regulated or highly sensitive research data unless your institution has approved the use and required safeguards are in place.
• Review generated files before sharing, publishing, or submitting them.

Report a vulnerability or security concern

Email office@wenora.ai with the subject "Security report." Include the affected URL or feature, clear reproduction steps, the potential impact, and a safe way to contact you. Please do not include real user data, disrupt the service, access another person's information, or publicly disclose an unresolved issue.

We will review good-faith reports and prioritize them based on severity and user impact. This page does not create a bug bounty or promise a payment.

Security limitations

No internet service can guarantee absolute security. We continuously improve safeguards as Wenora develops and update this page when material practices change.