Security & privacy

Your academic life, handled carefully

A secretary is only useful if you can trust it with everything. Here is how Welya earns that.

Authentication

Passwords are hashed with bcrypt. Sessions use signed JWT bearer tokens; email verification and password reset use single-use, expiring codes.

Per-account isolation

Every table is scoped by user id and every query is filtered by the authenticated user. Deleting an account cascades to all of its data.

Files

Uploads (≤ 25 MB, PDF/DOCX/images/text) are stored outside the web root and streamed only to their owner after authentication.

Grounded AI

Prompts contain only your own data. Model output must match a strict JSON schema; referenced ids are verified before display. Nothing is used to train models.

Transport

Production traffic is served over HTTPS. CORS is restricted to the Welya web and desktop origins.

Your controls

Export all data as JSON or permanently delete your account from Settings → Privacy. AI processing of emails and documents can be switched off per category.

AI processing, specifically

When you chat with Welya, confirm an inbox item, break down a task or analyze a document, the relevant slice of your data (tasks, schedule, the message or document text) is sent to a language model hosted on Azure AI Foundry. Requests are not stored by us beyond the resulting conversation you can see and delete, and are not used for model training.

If the model is unavailable or returns something that fails validation, Welya uses its built-in rule engine instead and labels the answer accordingly.

Found a vulnerability? Email security@welya.app. We respond within 72 hours.

Let Welya handle the secretarial work.

Completely free for students. Web and desktop.

Create your free account Download for desktop