Trust & Safety
AvailableSecurity
A practical overview of security expectations for a family heritage platform.Family knowledge can include private people, documents, memories, and consent decisions. Security must protect that context without making unsafe promises.
What this means
- Authentication, authorization, and backend-enforced privacy remain core boundaries.
- Frontend pages should never expose tokens, secrets, raw private data, or storage paths.
- Operational security work should be documented and verified in explicit phases.
How AINMAX supports this
- Protected routes are tested for safe unauthenticated states.
- Frontend deploys preserve secret hygiene and do not publish env files or repository-only instructions.
- Systemd runtime hardening has been accepted separately for backend process stability.
What is available now
- Public security resource page as static educational content.
- Production frontend deploy checks for forbidden files such as `.env` and `AGENTS.md`.
- Accepted health and protected-route checks in production deploy reports.
What is planned
- More detailed security center content.
- Expanded operational runbooks and incident-response documentation.
- Future security audit views only after separate approval.
This page does not disclose secrets, operational credentials, infrastructure internals, or security-sensitive implementation details.