What Arovi's own code actually does — not a marketing claim.

Approval Gate

Every consequential action — spending money, installing a package, modifying a file, publishing content, sending a message — passes through the same real Approval Gate. Approvals are bound to the exact action and parameters reviewed, not a generic permission, and can never be reused for a different action.

Secrets

API keys and credentials are always stored encrypted at rest — never in plain configuration files, never logged, never committed to source control.

Payments

Arovi never handles raw card data. Payment is processed entirely through our payment provider's own hosted checkout page.

Account security

• Passwords are hashed with a real, industry-standard algorithm — never stored in plain text.
• Every login creates a real, revocable session; revoking a session or device takes effect on its very next request.
• Multi-user approval ownership is enforced server-side — one account can never approve or view another account's private data without explicit shared-workspace permission.

Remote access

Companion (mobile) access uses outbound-only connections — Arovi never requires opening an inbound port on your router. Devices and remote sessions can be revoked at any time.

Reporting a security issue

If you believe you've found a security issue, please contact us — see the Contact page.