Trust

A signed-in user only sees workspace data after auth, MFA when required, legal acceptance when enforced, and workspace membership checks.

Provider calls run through workspace settings, active Lead Plan gates, spend ceilings, kill switches, and review queues.

CRM writes, outreach, billing changes, and destructive operations stay behind explicit approval boundaries.

Send eligibility, suppression, opt-outs, source allowed-use, and result claims are product gates, not just policy text. Auvra holds work when evidence or approval is weak.

Auvra separates official or reviewed source access from external execution. Source candidates, API exports, webhooks, and scheduled runs cannot approve terms, create contact intent, write CRM, send messages, or promote leads without the matching gate.

A do-not-contact or legal-hold mark on a contact overrides every consent basis in the send-eligibility decision - no message can be judged eligible past it.

Server errors are reported to Sentry after scrubbing. Request bodies, cookies, query strings, and user identity are removed first.

SOC 2, ISO 27001, SAML SSO, SCIM, and a formal no-cross-client-training attestation are roadmap controls until verified evidence exists. Client data is tenant-scoped today, but the attestation is not yet a verified control.

Time-of-day send windows (quiet hours) are not a supported control yet - nothing sends today regardless, because outbound execution itself is gate-disabled.

Usage is tracked as Auvra credits and raw provider units without exposing internal markup or provider-cost accounting to company users.

Public pages explain Auvra's terms, privacy practices, and providers without exposing private workspace data or implying unsupported automation.