Security, in plain terms.

Most security pages are written to sound impressive. This one is written so you can check it. Here is what Avlira does, what it does not do, and what we do not claim.

Agents sign in with a one-time code sent to their mobile number, with email as the backup. No passwords means no password reuse, no reset queue, and no credential list to leak. Codes expire in ten minutes and work once. Agents get a notice when a new device signs in, and can sign out every other device in one tap.

Read-only AI access

An agent connects their own ChatGPT or Claude with a one-time sign-in and approves a short list of read scopes. No write tool is exposed, so there is no path for an assistant to change a commission, mark dues paid or edit a W-9. Connections are per agent, visible to the office, and revocable at any time. Details on /for-ai.

Avlira does not ask for and does not store a typed SSN or TIN. Onboarding collects legal name, business name, entity type and an acknowledgement that the agent will supply a signed W-9. The W-9 arrives as a PDF or image. Onboarding forms refuse anything that looks like an SSN or TIN, so one can't be saved by accident.

W-9 files

Uploaded tax files live outside the public web root, readable by administrators only, with the file type and size checked on upload. Agents can see whether their file is on file; they cannot browse the office's files.

Audit log

The log records who did what and when: activations, deactivations, plan changes, commission edits, dues actions, statement generation, onboarding step completion, agreement acknowledgement, and AI connections and revocations. The point of the log is that when two people remember an event differently, there is a record.

One brokerage, one instance

Each brokerage runs on its own instance with its own users and its own data. An account belongs to one brokerage. Nothing is pooled across customers, and nothing is mixed into an office-wide total you cannot see the edges of. Export is available — your records do not become leverage.

What we do not claim

We are not a bank and do not hold your escrow or trust funds.
We are not your accounting system; we export to it.
We do not hold a certification we have not earned, and we will not put a badge on this page to look bigger.

Security questions for a specific brokerage, including a walkthrough of the data model: security@avlira.ai.