Security at AveLynx

Last updated: October 22, 2026. This page is written by Myzbros Enterprises LLC, doing business as AveLynx ("we", "us"). It says what we do to protect your information, what we rely on, what we do not yet have, and how to tell us about a problem. We have tried to state only what is true today.

Report a security problem

If you think you have found a weakness in anything we run, please write to [email protected]. The same address is listed in our security.txt file, which security researchers look for.

• Tell us what you found, where, and the steps to see it. Screenshots and the address of the page help. Plain text is fine.
• We will reply within two business days to say we have it, and we will keep you informed until it is fixed.
• Please give us a reasonable time to fix the problem before you tell anyone else.
• Please do not read, change or delete other people's information, do not slow down or break our services, and do not use deception, phishing or physical access. If you reach someone else's data by accident, stop and tell us.
• If you follow these rules and act in good faith, we will not take legal action against you for your research.
• We do not run a paid bounty program. We are glad to thank you by name if you want that.

How we protect your information

• Encryption in transit. Our sites use HTTPS only, with strict transport security so browsers do not try plain HTTP. The avelynx.net addresses accept only the current version of the protocol (TLS 1.3), and our domain name records are signed (DNSSEC).
• Where it runs. Our applications, databases and file storage run on Cloudflare.
• Who can sign in. People sign in and we check their identity on every request. A permissions service then decides what that person may do: their role, their organization and which apps. A request for another organization's data is refused, and automated tests check this.
• Backups. The GrantPulse grant-writing application and its search service are backed up every night and kept for 30 days. A second, encrypted copy is kept outside Cloudflare, and the key to it is held only by us.
• How we change software. Our code is in a private repository. Every commit is scanned for secrets and for customer names, and a finding stops it. We test changes and try them on a staging copy before they reach production.
• Payments. Card and bank details go straight to Stripe. We never see or store them.

Who we rely on

These companies handle information on our behalf. Their own security certifications belong to them, not to us.

• Cloudflare: hosting, our domain name service, databases, file storage and the AI models some features use.
• Amazon Web Services: encrypted off-site backup copies.
• Stripe: payments.
• Resend: email that our apps send, such as sign-in codes.
• Microsoft 365: our company email and calendars.

What we do not have yet

• We do not hold a SOC 2 report, ISO 27001 certificate or another independent certification. We follow written practices and keep dated records, and we will share our written policies on request under a confidentiality agreement.
• An independent penetration test of our systems has not been done yet.
• We are not set up to handle protected health information. Please do not put it in our apps.

Contact

Security problems: [email protected]. Everything else: [email protected]. Myzbros Enterprises LLC, doing business as AveLynx, 225 Broadway, San Diego, CA 92101.