Skip to content
Leg 04 · Evaluate · security one-pager

security, enforced.not promised.

For procurement, IT security and CISO review. One page, print-friendly. Isolation lives in the database, AI stays under human control, and every deeper detail is at the trust center. Last reviewed 2026-06-26.

Security at a glance
242tables isolated
AES-256encrypted at rest
1storage region
7yraudit retention
Tenant isolation

Enforced by the database.

Isolation is enforced at the database, not trusted to application code. Row-level security is load-bearing in production across 242 org-scoped tables. A missing org filter returns zero rows at the database edge, not another operator’s data.

5
Isolation layers
242
Tables under DB isolation
0
Rows without your operator
L1
Application filters every request
Every server endpoint filters records by the calling operator, enforced by middleware on every request.
L2
The database refuses to cross tenants
The database itself denies a cross-tenant read on every tenant-scoped table, even if a query forgets the org filter.
L3
The public surface is closed
External-facing roles cannot read any tenant data. The path is shut at the database role level, not just in the application.
L4
Workers stay in one operator
Background workers wrap every operation in a per-org context, so even cross-tenant aggregations cannot read across operators.
L5
A build gate holds the line
A CI gate blocks any new server endpoint that lacks the org filter. Every endpoint and worker is audit-tested before deploy.
Where data lives

AES-256 at rest, TLS in transit.

Every operator record in one named storage region, encrypted at rest and in transit, with a confidential reporter's identity kept off the record at write and redacted from every read below the clearance tier.

One storage region. Every operator record, database and file lives in a single named region, stated in the Data Processing Addendum. No stored data at the edge.

Same-region backup. Daily physical backups stay in the same region as the database, alongside the database they protect. No cross-region copy is made.

Encrypted in transit. HTTPS with HSTS enforced for two years including subdomains. TLS terminates at Vercel. TLS 1.1 and 1.0 are refused, and every TLS 1.2 suite observed is forward-secret AEAD. Measured at the edge, not vendor-attested.

Encrypted at rest. AES-256 on every database volume, file store and backup.

Provider-held keys. At-rest keys are held by the infrastructure provider. Bring-your-own-key is not supported today.

Confidential intake. The record carries no reporter identity (null at write), and every audit, timeline and export read redacts the reporter below the clearance tier. Anonymous is redacted for everyone, our own staff included.

Governed AI inference. Inference receives the record fields an agent is configured to read, such as title, narrative, classification and status. A confidential or anonymous reporter is never in the payload: the record carries no reporter identity.

We train nothing on your data. eAviora operates no model training pipeline, and the AI provider states it does not train on inputs or outputs. Ask us about onward routing and we will show you the document.

AI governance

AI proposes. Humans approve.

The first question a security team asks is whether the AI can change a safety record. It cannot, not on its own and not through the API. Workflow stage and sign-off are reserved for people.

Humans hold governance. Workflow and sign-off state cannot be set by an AI model or the API. A machine can suggest, never decide.

One-click approval. Every AI write surfaces as a human approval card: accept, modify or reject, and the decision is logged.

Confidence-gated. Low-confidence or out-of-catalog output is queued for a human. Nothing is silently written.

Confidential through the copilot. ICAO Annex 19 confidentiality is enforced inside the AI assistant. A report you are not cleared for is simply not there.

No training here, bounded input. Inference receives the fields an agent is configured to read, never a confidential reporter identity. eAviora trains no model on operator data.

NORTHGALE AIR · SYNTHETIC OPERATION
OCC-2026-0042AWAITING SIGN-OFF
ICAO classificationAI · 94%
Loss of control, in-flight (LOC-I), proposed
Risk bandAI · 88%
4C · Tolerable, monitor
Write to recordHUMAN
Held. A person accepts, changes or rejects. Nothing is written until then.
Confidentiality

Annex 19 sensitivity, enforced.

Every record carries a sensitivity tier, and it holds through the queue, notifications, partner sharing and the copilot. Access defaults to denied.

Three sensitivity tiers. Every record carries an ICAO Annex 19 tier, protected, restricted or confidential, with role allowlists and explicit per-user clearance grants.

Enforced everywhere. Sensitivity holds into the personal work queue, notifications, partnership data-sharing scope and the AI assistant, uniformly, not per-screen.

Fail closed. Without a clearance grant the record is invisible: no row, no notification, no AI answer. Access defaults to denied.

Just culture preserved. Reporter identity is dropped from the record at intake and redacted on every read, so the confidential tier protects the person, not just the document.

Authentication

Federation, and account security.

Sign in the way your identity provider works, with phishing-resistant passkeys, step-up MFA and scoped API keys behind it.

SAML 2.0. Per-org enterprise SSO, JIT user provisioning, attribute-mapped roles, an SP metadata endpoint.

SCIM 2.0. Automated joiner and leaver provisioning, bearer-token auth (hashed, shown once on create).

OAuth sign-in. Google, Microsoft and Okta, per-org. Require SSO to disable password sign-in.

Passkeys and MFA. WebAuthn passkeys (Touch ID, Windows Hello, security key), phishing-resistant, plus TOTP with step-up on sensitive actions and admin reset.

Session controls. Sign-in history (last 20), active-session listing and sign-out-everywhere.

API keys. Bearer auth with a per-key scope (read, write or admin; settings management is admin-only), last-used tracking and per-key audit logging. Enterprise plans.

API and integrations

Open by design, governed by default.

Every machine call runs the same checks as a user. Governance state stays human-only, whether it arrives from the API, the connector or an AI assistant.

REST API v1. A versioned public API with an OpenAPI 3.1 contract generated from the live runtime. Per-key scopes, every call rate-limited, tenant-isolated and audit-logged.

OAuth 2.1 connector. Dynamic client registration (RFC 7591), mandatory PKCE (S256), single-use authorization codes, short-lived 1h access and 30-day rotating refresh, scoped per-tenant consent.

MCP server. A Model Context Protocol server runs the same authorization, isolation and audit path as the screen. Bearer-authenticated and stateless.

Signed webhooks. HMAC-SHA256 signed for verification, SSRF-hardened against internal targets, with rotate-secret (shown once) controls.

Audit posture

Logged in the same step.

The audit entry commits in the same transaction as the change it records, so the log can never fall out of sync with the data. Append-only and tamper-evident in the database, and gated in CI so it stays that way.

1
Transaction, log and change
7yr
Minimum safety retention
0
Deletes on the log
LOG
Everything is logged
Every record, workflow and admin change: action, entity, before and after, actor, IP, request id and API key id.
TXN
It cannot be bypassed
The audit row commits in the same database step as the change itself, not a separate skippable insert. The log and the change succeed or fail together.
7YR
Retained, never purged
Safety records are retained a minimum of 7 years (ICAO Annex 13), never auto-purged.
FIND
Searchable and exportable
Searchable in-tenant by entity, actor, date and action. Export to JSON or CSV.
SEAL
Tamper-evident
Append-only in the database itself: a revoked grant and a table trigger refuse update outright, and refuse delete outside one named, gated maintenance path.
Data portability

Your data, on demand.

Trigger a full export any time, records and the audit log, in open formats. Import with a mapped CSV, no proprietary schema required. No lock-in, no ticket.

Bulk export. Asynchronous export to JSON or CSV, delivered as a 7-day signed download link.

Streaming export. Line-delimited JSON (NDJSON) streaming for large datasets.

Mapped import. CSV import (up to 50MB, processed in chunks). No proprietary format required.

Privacy requests. A GDPR data-subject-request flow, a DPA template and a public sub-processor list.

Retention control. Configurable retention for operational history (AI runs, sessions, notifications, webhooks). Safety records are retained.

Regulator alignment

Mapped to the frameworks your authority audits.

Notification clocks, report deadlines and just-culture flows mapped to the frameworks your authority audits against, verified against the shipped platform.

ANX 13
ICAO Annex 13
24h notification and final-report deadlines auto-tracked. Investigation phases mapped to workflow stages.
EU 376
EU 376/2014
72h preliminary and 30d final-report deadlines auto-tracked. A just-culture decision flow is built in.
ANX 19
ICAO Annex 19
SMS module aligned: hazards, safety performance indicators, risk matrix, just culture, safety culture.
PART 5
14 CFR Part 5 / AC 120-92
FAA SMS framework. NTSB Form 6120 export.
CAR 107
CAR 107 / TC AC 107-001
Transport Canada SMS. TSB notification workflow.
GDPR
EU GDPR
Data-subject-request flow. DPA template available. Sub-processor list public.
EXPORT
Regulator export envelopes
ADREP, E5X and SDR envelopes are JSON today. An XML serialization is on the roadmap.
Certifications

Where we stand today.

Stated plainly. SOC 2 is in preparation, not held, and the controls stand on their own by construction.

SOC 2
SOC 2 Type I, in preparation
SOC 2 Type I is in preparation. No certification is claimed today. Type II follows the required observation period.
Sub-processors

Categories in the processing chain.

Every service that touches your data, listed by category and role. Vendor names and agreements are published in the legal homes below.

DB
Database
Tenant data, audit log and AI execution log. Single-region, encrypted at rest.
EDGE
Hosting and edge
Application and static assets served from a global edge with automatic SSL.
AI
AI provider
Calibrated agents for classification, risk, bow-tie and precursor detection. eAviora trains nothing on operator data, and the provider states it does not either.
JOBS
Background processing
Durable workers for notifications, retention, scheduled reports and webhook delivery.
MAIL
Email delivery
Transactional email for notifications, magic-links and digests.
IDP
Identity and storage
Sessions, file uploads, and OAuth or SAML callback for enterprise identity providers.
OBSV
Security monitoring
Error tracking and observability. Stack traces only, operator records are never sent.
PAY
Payments
Subscription billing on enterprise plans, handled by an external processor. eAviora never stores card data.
DNS
DNS and DDoS protection
Authoritative DNS, DDoS mitigation and TLS at the edge.

The full sub-processor list with vendor names and DPA links lives in the Privacy Policy 12 and Terms 09, the legal homes for processor disclosure.

Procurement · one walkthrough

Print this page. We cover the rest live.

Isolation in the database.Row-level security across 242 tables, not app-code filtering. One operator can never read another.
We never train on your data.Tenant data is not used to improve our AI for anyone else. Ever.
SOC 2 Type I in preparation.We do not claim a certificate we do not hold. The controls stand by construction.

Print this page (Cmd+P or Ctrl+P) or hand the URL to your security team. Report a vulnerability to contact@eaviora.com: 24h acknowledgement, 7-day fix for Critical and High, and we credit you in the advisory. Last reviewed 2026-06-26.

01 WHY 02 THE SHIFT 03 PLATFORM 04 EVALUATE 05 ADOPT
Next leg
05 · Adopt it

The one-pager answers the questionnaire. The next leg is the experience: demo to production.