Security
Secure foundations for building and publishing apps
AppWeaver AI combines authenticated workspaces, server-side authorization, admin oversight, audit trails, and verified payment webhooks to keep public and private app workflows controlled.
Authentication
Customer sign-in is powered by Better Auth with email/password, Google, GitHub, and email verification flows configured in the application.
Admin roles and permissions
The admin console enforces role-based permissions for users, projects, subscriptions, payments, analytics, security events, audit logs, and settings.
Audit and security events
Privileged admin actions are written to an audit log, while login, logout, verification, abuse, and security signals are recorded as security events.
Data protection
Application data is stored through Prisma and PostgreSQL, with server-side access checks around dashboard, project, billing, and admin workflows.
Secrets and environment configuration
Sensitive keys such as Stripe, OAuth, database, and AI provider credentials are read from server-side environment variables and are not committed to the repository.
Payments and webhook verification
Stripe checkout, subscriptions, billing portal sessions, refunds, and webhook signature verification are handled server-side.
Publishing controls
Published projects support visibility states, access checks, and server routes that separate public viewers from authenticated workspace editing.
Enterprise security discussions
SSO/SAML, advanced privacy controls, dedicated environments, and deployment requirements are handled through the enterprise contact-sales process.
Compliance note
This page describes AppWeaver AI application capabilities visible in the current product. It does not claim SOC 2, ISO 27001, HIPAA, GDPR certification, or other formal attestations. Teams with procurement or security review requirements should contact sales so we can discuss the exact controls and documentation needed for their rollout.