Security

Last updated 28 October 2026

How Elora keeps your information and your clients' information safe. This page describes only what is built and running today.

1. Encrypted connections

Elora is served only over HTTPS: a plain http address, or the address without www, is sent straight to https://www.askelora.io.
Browsers are told to use only HTTPS for www.askelora.io for a year (HSTS).
Login cookies are encrypted, marked secure and not readable by scripts.
Every page tells the browser to load nothing from other sites and never to show Elora inside another site's frame. The public pages load no scripts at all.

2. Tokens and keys

Access tokens for connected platforms, AI provider keys and website connector keys are encrypted with AES-256 by the application before they are stored, in Elora's vault.
Each secret is sealed for its own agency and workspace, so it never opens as another's.
The keys that open the vault are themselves locked with a master key kept in a file on the server, outside the database, so the database alone opens nothing.
A saved token or key is never shown again, never sent to your browser and never written to a log. Elora shows at most a key's last four characters.
Passwords are stored only as salted, one-way hashes.

3. Each agency and workspace kept apart

Every record carries its agency and workspace, and a person sees only the workspaces their role reaches.
On Elora's SQL Server database, the database itself enforces this with row-level security, beneath the application's own checks.
Each AI request is made for one workspace at a time.

There is no public sign-up: people join Elora only when an administrator invites them, and a Microsoft or Google sign-in never makes an account on its own.
Signing in with email and password always needs a code from an authenticator app as well (two-step sign-in), set up at the first sign-in.
After five wrong passwords an account locks for 15 minutes, and the sign-in page limits how often one internet address can try.
Each agency chooses the ways its people may sign in, an idle time-out and, if it wants, a list of office internet addresses to allow sign-in from.
You can sign yourself out of every device from your profile, and a person whose role is changed or removed is signed out.

5. Roles

Everyone has a role. Agency roles (agency admin, marketer, approver) reach the agency's own workspaces; client roles (client admin, contributor, viewer) reach only their own workspace.
Only an agency's admins set its sign-in rules and AI connections, and only admins invite people: an agency admin for the agency, a client admin for their own workspace. Viewers can read but not change anything.

6. Audit log

Elora keeps an audit log of sign-ins, failed sign-ins, lock-outs and sign-outs, invitations accepted, and every change to workspaces, people, connections and settings, with the date, time and internet address.
The audit log is append-only: its lines are never changed, and are deleted only after 25 months.

7. How long we keep data

Marketing data synced from connected accounts is kept up to 25 months, then deleted automatically (reports compare 24 full months).
The full list is in our privacy policy, and how to have data deleted sooner is on our data deletion page.

8. Backups

Tokens and keys stay encrypted in every copy of the database, backups included: they open only with the vault's master key, which is kept apart from the database.

9. Elora's AI

Elora's AI runs on the AI provider account the agency connects (Settings, AI), or a workspace's own account when the agency's admins give it one.
That account's key is kept in the vault like every other secret.

10. Reporting a security issue

If you think you have found a security problem in Elora, email privacy@askelora.io with the subject "Security issue". Tell us what you found and how to see it, and please give us time to fix it before telling anyone else. Please do not access or change other people's data while testing.

Draft for legal review.