Aurex handles funds and identity data. This page describes the controls we operate today. It is maintained by our team — not independently audited or third-party certified.
Email + password and Google sign-in via Supabase Auth. Passwords are hashed by the auth provider and never stored in plaintext.
Sensitive actions (deposits, withdrawals, trades) require an approved KYC verification.
Row-Level Security is enabled on every user-data table. Users can only read and write their own rows.
Balances, approval flags, and referral codes are pinned at the database layer — they cannot be modified by client requests.
We collect the minimum data needed to operate the platform: contact details, KYC documents, transaction history, and trading activity.
KYC documents and deposit screenshots are stored in private buckets and accessible only to you and our team.
Deposits require a screenshot proof and are reviewed by our team before being credited. Withdrawals are reviewed and processed manually.
Withdrawal requests cannot exceed your current balance; the database rejects out-of-balance requests.
Aurex runs on Lovable Cloud with Supabase (Postgres, Auth, Storage, Realtime). Database access is gated by RLS; privileged operations use audited, role-checked server functions.
Secrets and service keys are kept server-side and are never shipped to the browser bundle.
If you believe you have found a vulnerability, please reach out through the in-app Support page with as much detail as possible.
We aim to acknowledge reports within a few business days.
Last updated: June 2026. This page is editable project content and describes our current practices; it is not a certification or legal warranty.