security, enforced.not promised.
For procurement, IT security and CISO review. One page, print-friendly. Isolation lives in the database, AI stays under human control, and every deeper detail is at the trust center. Last reviewed 2026-06-26.
Enforced by the database.
Isolation is enforced at the database, not trusted to application code. Row-level security is load-bearing in production across 242 org-scoped tables. A missing org filter returns zero rows at the database edge, not another operator’s data.
AES-256 at rest, TLS in transit.
Every operator record in one named storage region, encrypted at rest and in transit, with a confidential reporter's identity kept off the record at write and redacted from every read below the clearance tier.
One storage region. Every operator record, database and file lives in a single named region, stated in the Data Processing Addendum. No stored data at the edge.
Same-region backup. Daily physical backups stay in the same region as the database, alongside the database they protect. No cross-region copy is made.
Encrypted in transit. HTTPS with HSTS enforced for two years including subdomains. TLS terminates at Vercel. TLS 1.1 and 1.0 are refused, and every TLS 1.2 suite observed is forward-secret AEAD. Measured at the edge, not vendor-attested.
Encrypted at rest. AES-256 on every database volume, file store and backup.
Provider-held keys. At-rest keys are held by the infrastructure provider. Bring-your-own-key is not supported today.
Confidential intake. The record carries no reporter identity (null at write), and every audit, timeline and export read redacts the reporter below the clearance tier. Anonymous is redacted for everyone, our own staff included.
Governed AI inference. Inference receives the record fields an agent is configured to read, such as title, narrative, classification and status. A confidential or anonymous reporter is never in the payload: the record carries no reporter identity.
We train nothing on your data. eAviora operates no model training pipeline, and the AI provider states it does not train on inputs or outputs. Ask us about onward routing and we will show you the document.
AI proposes. Humans approve.
The first question a security team asks is whether the AI can change a safety record. It cannot, not on its own and not through the API. Workflow stage and sign-off are reserved for people.
Humans hold governance. Workflow and sign-off state cannot be set by an AI model or the API. A machine can suggest, never decide.
One-click approval. Every AI write surfaces as a human approval card: accept, modify or reject, and the decision is logged.
Confidence-gated. Low-confidence or out-of-catalog output is queued for a human. Nothing is silently written.
Confidential through the copilot. ICAO Annex 19 confidentiality is enforced inside the AI assistant. A report you are not cleared for is simply not there.
No training here, bounded input. Inference receives the fields an agent is configured to read, never a confidential reporter identity. eAviora trains no model on operator data.
Annex 19 sensitivity, enforced.
Every record carries a sensitivity tier, and it holds through the queue, notifications, partner sharing and the copilot. Access defaults to denied.
Three sensitivity tiers. Every record carries an ICAO Annex 19 tier, protected, restricted or confidential, with role allowlists and explicit per-user clearance grants.
Enforced everywhere. Sensitivity holds into the personal work queue, notifications, partnership data-sharing scope and the AI assistant, uniformly, not per-screen.
Fail closed. Without a clearance grant the record is invisible: no row, no notification, no AI answer. Access defaults to denied.
Just culture preserved. Reporter identity is dropped from the record at intake and redacted on every read, so the confidential tier protects the person, not just the document.
Federation, and account security.
Sign in the way your identity provider works, with phishing-resistant passkeys, step-up MFA and scoped API keys behind it.
SAML 2.0. Per-org enterprise SSO, JIT user provisioning, attribute-mapped roles, an SP metadata endpoint.
SCIM 2.0. Automated joiner and leaver provisioning, bearer-token auth (hashed, shown once on create).
OAuth sign-in. Google, Microsoft and Okta, per-org. Require SSO to disable password sign-in.
Passkeys and MFA. WebAuthn passkeys (Touch ID, Windows Hello, security key), phishing-resistant, plus TOTP with step-up on sensitive actions and admin reset.
Session controls. Sign-in history (last 20), active-session listing and sign-out-everywhere.
API keys. Bearer auth with a per-key scope (read, write or admin; settings management is admin-only), last-used tracking and per-key audit logging. Enterprise plans.
Open by design, governed by default.
Every machine call runs the same checks as a user. Governance state stays human-only, whether it arrives from the API, the connector or an AI assistant.
REST API v1. A versioned public API with an OpenAPI 3.1 contract generated from the live runtime. Per-key scopes, every call rate-limited, tenant-isolated and audit-logged.
OAuth 2.1 connector. Dynamic client registration (RFC 7591), mandatory PKCE (S256), single-use authorization codes, short-lived 1h access and 30-day rotating refresh, scoped per-tenant consent.
MCP server. A Model Context Protocol server runs the same authorization, isolation and audit path as the screen. Bearer-authenticated and stateless.
Signed webhooks. HMAC-SHA256 signed for verification, SSRF-hardened against internal targets, with rotate-secret (shown once) controls.
Logged in the same step.
The audit entry commits in the same transaction as the change it records, so the log can never fall out of sync with the data. Append-only and tamper-evident in the database, and gated in CI so it stays that way.
Your data, on demand.
Trigger a full export any time, records and the audit log, in open formats. Import with a mapped CSV, no proprietary schema required. No lock-in, no ticket.
Bulk export. Asynchronous export to JSON or CSV, delivered as a 7-day signed download link.
Streaming export. Line-delimited JSON (NDJSON) streaming for large datasets.
Mapped import. CSV import (up to 50MB, processed in chunks). No proprietary format required.
Privacy requests. A GDPR data-subject-request flow, a DPA template and a public sub-processor list.
Retention control. Configurable retention for operational history (AI runs, sessions, notifications, webhooks). Safety records are retained.
Mapped to the frameworks your authority audits.
Notification clocks, report deadlines and just-culture flows mapped to the frameworks your authority audits against, verified against the shipped platform.
Where we stand today.
Stated plainly. SOC 2 is in preparation, not held, and the controls stand on their own by construction.
Categories in the processing chain.
Every service that touches your data, listed by category and role. Vendor names and agreements are published in the legal homes below.
The full sub-processor list with vendor names and DPA links lives in the Privacy Policy 12 and Terms 09, the legal homes for processor disclosure.
Print this page. We cover the rest live.
Print this page (Cmd+P or Ctrl+P) or hand the URL to your security team. Report a vulnerability to contact@eaviora.com: 24h acknowledgement, 7-day fix for Critical and High, and we credit you in the advisory. Last reviewed 2026-06-26.
The one-pager answers the questionnaire. The next leg is the experience: demo to production.