Security

How your files are handled

A file you submit is streamed directly to the detection engine and is not stored. The API reads the upload from the request and writes it to the scanning daemon over a local socket — no copy is persisted to a database, object store, or backup. Once the verdict is returned, the file is gone.

Our server logs record only the file extension, size, and verdict for operational and diagnostic purposes — never the file contents, and never the filename, which frequently carries personal information. Scanning happens entirely within our own infrastructure — your files are not sent to any third party, and they are not used to train anything.

Encryption in transit

All traffic to geneav is served over HTTPS, with certificates issued and renewed automatically by Let's Encrypt. Plain HTTP requests are redirected to HTTPS. Inside our infrastructure, services communicate over a private Docker network that is not reachable from the internet.

Credentials and authentication

• Passwords are hashed with BCrypt. We never store or log the plaintext. Our policy requires at least 12 characters drawn from three of four character classes, and rejects common passwords and passwords containing your email address.
• API keys are generated from a cryptographically secure random source and stored only as a one-way SHA-256 hash. We keep a short prefix and the last four characters so you can recognise a key in your dashboard. The full key is shown once, at creation, and cannot be recovered — only revoked and replaced.
• Sessions use an HttpOnly, SameSite=Lax cookie that JavaScript cannot read. The session identifier is rotated on sign-in to prevent session fixation, and changing your password invalidates every existing session.
• Password resets use a single-use token that is itself stored hashed, expires after 10 minutes, and is rate limited. The reset endpoint returns the same response whether or not an account exists, so it cannot be used to enumerate users.

Abuse and availability protection

geneav applies rate limiting at two independent layers: a per-IP limit at the reverse proxy, and per-account token buckets in the application, with a tighter budget on authentication endpoints to resist password guessing. Rate limiting runs before the request body is read, so a throttled upload is rejected without consuming server resources.

A global cap on simultaneous scans protects the detection engine from resource exhaustion, and uploads are capped at 25 MB. Together these mean a single noisy client cannot degrade the service for everyone else.

Infrastructure

geneav runs on Amazon Web Services in the US East (N. Virginia) region. Application components run as isolated containers on a private network; only ports 80 and 443 are published to the host at all, and the instance firewall admits only those two from the internet.

Deployments are automated from version control and require no inbound SSH access — the server has no SSH port open to the internet. Releases are delivered through AWS's authenticated management plane using short-lived federated credentials, with automatic rollback if a release fails its health check. Malware signature databases are updated automatically and regularly from the ClamAV project.

Subprocessors

These are the only third parties that process data on our behalf. Note that none of them receive the files you scan — scanning is performed in-house.

The chat assistant is optional and separate from the scanning API. Please do not paste sensitive data into it. See our Privacy Policy for how each category of data is used.

Reporting a vulnerability

If you believe you have found a security issue, please email admin@geneav.com with enough detail to reproduce it. We aim to acknowledge reports within 3 business days and to keep you updated until the issue is resolved.

We ask that you give us a reasonable opportunity to fix an issue before disclosing it publicly, avoid accessing or modifying other users' data, and refrain from testing that degrades the service for others — no denial-of-service or high-volume automated scanning. We will not pursue action against researchers who follow these guidelines in good faith. We do not currently run a paid bug bounty, but we are glad to credit you.

What we have not built yet

Most security pages list only strengths. We would rather you learn these from us than discover them later:

• No SOC 2, ISO 27001, or third-party penetration test. These are on the roadmap and honestly represented as absent today.
• Single region, no failover. All processing happens in AWS US East (N. Virginia). We cannot currently offer EU or other data-residency options, and an outage in that region is an outage for the service.
• No scan history or audit log. Verdicts are returned to you and not retained, so we cannot reconstruct a record of past scans on your behalf.
• No SSO, teams, or role-based access. Accounts are individual, with a single permission level.
• No uptime SLA. We do not currently offer a contractual availability commitment.

If one of these is a blocker for you, email us — knowing which gaps matter most is how we decide what to build next.

A note on detection

geneav's detection is signature-based, powered by ClamAV. It reliably catches known malware, but a clean verdict is not proof that a file is safe — novel or deliberately obfuscated threats can pass. geneav is one layer in a security programme, not a replacement for endpoint protection, access control, and patching. Our Terms of Service set this out in full.

Security contact

For vulnerability reports, security questionnaires, or data-processing agreements, email admin@geneav.com.