Skip to content
Leg 04 · Evaluate · security one-pager

security, enforced.not promised.

For procurement, IT security and CISO review. One page, print-friendly. Isolation lives in the database, AI stays under human control, and every deeper detail is at the trust center. Last reviewed 2026-06-26.

Security at a glance
119tables isolated
AES-256encrypted at rest
1Canadian region
7yraudit retention
Tenant isolation

Enforced by the database.

Isolation is enforced at the database, not trusted to application code. Row-level security is load-bearing in production across 119 org-scoped tables. A missing org filter returns zero rows at the database edge, not another operator’s data.

5
Isolation layers
119
Tables under DB isolation
0
Rows without your operator
L1
Application filters every request
Every server endpoint filters records by the calling operator, enforced by middleware on every request.
L2
The database refuses to cross tenants
The database itself denies a cross-tenant read on every tenant-scoped table, even if a query forgets the org filter.
L3
The public surface is closed
External-facing roles cannot read any tenant data. The path is shut at the database role level, not just in the application.
L4
Workers stay in one operator
Background workers wrap every operation in a per-org context, so even cross-tenant aggregations cannot read across operators.
L5
A build gate holds the line
A CI gate blocks any new server endpoint that lacks the org filter. Every endpoint and worker is audit-tested before deploy.
Where data lives

Canada. Encrypted. Yours.

Every operator record in one Canadian region, encrypted at rest and in transit, with confidential reporter identity dropped before it is ever stored.

Canadian residency. Every operator record, database and file lives in one region (ca-central-1). No stored data at the edge.

Same-region backup. Backups stay in ca-central-1. Multi-region is available on enterprise contracts.

Encrypted in transit. TLS 1.3 only, HSTS enforced, modern cipher suites only.

Encrypted at rest. AES-256-GCM on every database and every backup.

Customer-managed keys. Bring-your-own-key (BYOK) is available on Tier-1 contracts.

Confidential intake. Reporter identity is dropped at intake (null-at-write), never stored, encrypted or otherwise. Stricter than encryption.

Governed AI inference. Inference runs against a US-region provider on a sanitised payload only, no personal data, no narrative text. EU-only inference is configurable per tenant.

No training on your data. Operator data is never used to train AI models.

AI governance

AI proposes. Humans approve.

The first question a security team asks is whether the AI can change a safety record. It cannot, not on its own and not through the API. Workflow stage and sign-off are reserved for people.

Humans hold governance. Workflow and sign-off state cannot be set by an AI model or the API. A machine can suggest, never decide.

One-click approval. Every AI write surfaces as a human approval card: accept, modify or reject, and the decision is logged.

Confidence-gated. Low-confidence or out-of-catalog output is queued for a human. Nothing is silently written.

Confidential through the copilot. ICAO Annex 19 confidentiality is enforced inside the AI assistant. A report you are not cleared for is simply not there.

No training, sanitised input. Inference runs on a sanitised payload only. Operator data never trains a model.

NORTHGALE AIR · SYNTHETIC OPERATION
OCC-2026-0042AWAITING SIGN-OFF
ICAO classificationAI · 94%
Loss of control, in-flight (LOC-I), proposed
Risk bandAI · 88%
4C · Tolerable, monitor
Write to recordHUMAN
Held. A person accepts, changes or rejects. Nothing is written until then.
Confidentiality

Annex 19 sensitivity, enforced.

Every record carries a sensitivity tier, and it holds through the queue, notifications, partner sharing and the copilot. Access defaults to denied.

Three sensitivity tiers. Every record carries an ICAO Annex 19 tier, protected, restricted or confidential, with role allowlists and explicit per-user clearance grants.

Enforced everywhere. Sensitivity holds into the personal work queue, notifications, partnership data-sharing scope and the AI assistant, uniformly, not per-screen.

Fail closed. Without a clearance grant the record is invisible: no row, no notification, no AI answer. Access defaults to denied.

Just culture preserved. Reporter identity is dropped at intake, so the confidential tier protects the person, not just the document.

Authentication

Federation, and account security.

Sign in the way your identity provider works, with phishing-resistant passkeys, step-up MFA and scoped API keys behind it.

SAML 2.0. Per-org enterprise SSO, JIT user provisioning, attribute-mapped roles, an SP metadata endpoint.

SCIM 2.0. Automated joiner and leaver provisioning, bearer-token auth (hashed, shown once on create).

OAuth sign-in. Google, Microsoft and Okta, per-org. Require SSO to disable password sign-in.

Passkeys and MFA. WebAuthn passkeys (Touch ID, Windows Hello, security key), phishing-resistant, plus TOTP with step-up on sensitive actions and admin reset.

Session controls. Sign-in history (last 20), active-session listing and sign-out-everywhere.

API keys. Bearer auth with per-key scopes (records, actions, audit, webhooks), last-used tracking and per-key audit logging. Enterprise plans.

API and integrations

Open by design, governed by default.

Every machine call runs the same checks as a user. Governance state stays human-only, whether it arrives from the API, the connector or an AI assistant.

REST API v1. A versioned public API with an OpenAPI 3.1 contract generated from the live runtime. Per-key scopes, every call rate-limited, tenant-isolated and audit-logged.

OAuth 2.1 connector. Dynamic client registration (RFC 7591), mandatory PKCE (S256), single-use authorization codes, short-lived 1h access and 30-day rotating refresh, scoped per-tenant consent.

MCP server. A Model Context Protocol server runs the same authorization, isolation and audit path as the screen. Bearer-authenticated and stateless.

Signed webhooks. HMAC-SHA256 signed for verification, SSRF-hardened against internal targets, with rotate-secret (shown once) controls.

Audit posture

Logged in the same step.

The audit entry commits in the same transaction as the change it records, so the log can never fall out of sync with the data. Append-only, tamper-evident, and enforced by a CI gate.

1
Transaction, log and change
7yr
Minimum safety retention
0
Deletes on the log
LOG
Everything is logged
Every record, workflow and admin change: action, entity, before and after, actor, IP, request id and API key id.
TXN
It cannot be bypassed
The audit row commits in the same database step as the change itself, not a separate skippable insert. The log and the change succeed or fail together.
7YR
Retained, never purged
Safety records are retained a minimum of 7 years (ICAO Annex 13), never auto-purged.
FIND
Searchable and exportable
Searchable in-tenant by entity, actor, date and action. Export to JSON or CSV.
SEAL
Tamper-evident
Append-only. No update or delete ever touches the audit log, enforced by a CI gate.
Data portability

Your data, on demand.

Trigger a full export any time, records and the audit log, in open formats. Import with a mapped CSV, no proprietary schema required. No lock-in, no ticket.

Bulk export. Asynchronous export to JSON, CSV, Parquet or PDF, delivered as a 7-day signed download link.

Streaming export. Line-delimited JSON (NDJSON) streaming for large datasets.

Mapped import. CSV import (up to 50MB, processed in chunks). No proprietary format required.

Privacy requests. A GDPR data-subject-request flow, a DPA template and a public sub-processor list.

Retention control. Configurable retention for operational history (AI runs, sessions, notifications, webhooks). Safety records are retained.

Regulator alignment

Built for the regulator’s notebook.

Notification clocks, report deadlines and just-culture flows mapped to the frameworks your authority audits against, proven on a live cluster.

ANX 13
ICAO Annex 13
24h notification and final-report deadlines auto-tracked. Investigation phases mapped to workflow stages.
EU 376
EU 376/2014
72h preliminary and 30d final-report deadlines auto-tracked. A just-culture decision flow is built in.
ANX 19
ICAO Annex 19
SMS module aligned: hazards, safety performance indicators, risk matrix, just culture, safety culture.
PART 5
14 CFR Part 5 / AC 120-92
FAA SMS framework. NTSB Form 6120 export.
CAR 107
CAR 107 / TC AC 107-001
Transport Canada SMS. TSB notification workflow.
GDPR
EU GDPR
Data-subject-request flow. DPA template available. Sub-processor list public.
EXPORT
Regulator export envelopes
ADREP, E5X and SDR envelopes are JSON today. An XML serialization is on the roadmap.
Certifications

Where we stand today.

Stated plainly. SOC 2 is in preparation, not held, and the controls stand on their own by construction.

SOC 2 I
SOC 2 Type I, in preparation
Observation in progress, started Q2 2026. We do not claim a certificate we do not hold.
SOC 2 II
SOC 2 Type II, targeted
6+ months of observation after Type I, targeting Q4 2026.
Sub-processors

Categories in the processing chain.

Every service that touches your data, listed by category and role. Vendor names and agreements are published in the legal homes below.

DB
Database
Tenant data, audit log and AI execution log. Single-region, encrypted at rest.
EDGE
Hosting and edge
Application and static assets served from a global edge with automatic SSL.
AI
AI provider
Calibrated agents for classification, risk, bow-tie and precursor detection. Operator data is never used to train models.
JOBS
Background processing
Durable workers for notifications, retention, scheduled reports and webhook delivery.
MAIL
Email delivery
Transactional email for notifications, magic-links and digests.
IDP
Identity and storage
Sessions, file uploads, and OAuth or SAML callback for enterprise identity providers.
OBSV
Security monitoring
Error tracking and observability. Stack traces only, operator records are never sent.
PAY
Payments
Subscription billing on enterprise plans, handled by an external processor. eAviora never stores card data.
DNS
DNS and DDoS protection
Authoritative DNS, DDoS mitigation and TLS at the edge.

The full sub-processor list with vendor names and DPA links lives in the Privacy Policy 12 and Terms 09, the legal homes for processor disclosure.

Procurement · one walkthrough

Print this page. We cover the rest live.

Isolation in the database.Row-level security across 119 tables, not app-code filtering. One operator can never read another.
Your data never trains a model.Tenant data is not used to improve our AI for anyone else. Ever.
SOC 2 Type II, underway.We do not claim a certificate we do not hold. The controls stand by construction.

Print this page (Cmd+P or Ctrl+P) or hand the URL to your security team. Report a vulnerability to security@eaviora.com: 24h acknowledgement, 7-day fix for Critical and High, and we credit you in the advisory. Last reviewed 2026-06-26.

01 WHY 02 THE SHIFT 03 PLATFORM 04 EVALUATE 05 ADOPT
Next leg
05 · Adopt it

The one-pager answers the questionnaire. The next leg is the experience: demo to production, with the design partner cohort.