← Back to Aliena AI
ALL SYSTEMS OPERATIONAL
Security at Aliena AI
We build Aliena AI with security as a first principle. Your project data, financial plans, and team information are protected at every layer of our stack.
AES-256
Encryption standard
TLS 1.2+
In-transit security
Row-Level
Database security
01
Data Protection
Encryption at rest
All data stored in Supabase (PostgreSQL) is encrypted at rest using AES-256. Backups are encrypted with the same standard.
Encryption in transit
All connections use TLS 1.2 or higher. We enforce HTTPS across all endpoints with HSTS headers.
Row-Level Security
Every database table uses Supabase Row-Level Security (RLS) policies. Users can only access data belonging to their organisation -- enforced at the database level, not just the application layer.
Data isolation
Each organisation's data is logically isolated by organisation_id on every table. Cross-organisation data access is structurally impossible through normal query paths.
02
Infrastructure
Hosting
Aliena AI runs on Vercel (edge network, 99.99% SLA) with database hosted on Supabase (built on AWS). Both are SOC 2 Type II certified.
Secret management
API keys and secrets are stored as encrypted environment variables in Vercel. Service role keys are never exposed client-side. Secrets are rotated quarterly.
Authentication
Authentication is handled by Supabase Auth (built on GoTrue). We support email/password with secure password hashing (bcrypt). Session tokens are short-lived JWTs verified server-side on every request.
Audit logging
All approval decisions, document changes, and resource allocation changes are logged to immutable audit tables with actor, timestamp, and before/after values.
04
Access Controls
Principle of least privilege
Every API route authenticates the requesting user and verifies organisation membership before returning data. Admin operations require elevated role checks.
No shared credentials
Each user has their own account. There are no shared login credentials. Team members are invited via email and must verify their identity.
MFA for admin access
All Aliena AI team members with production database access are required to use multi-factor authentication.
Approval workflows
Sensitive operations (document approval, budget sign-off) require multi-step approval chains with full audit trails.
03
Compliance Roadmap
ISO 27001In progress
We are working towards ISO 27001 certification. Our ISMS documentation and risk register are in development.
SOC 2 Type IIPlanned
SOC 2 Type II audit is planned for 2026. We are implementing the required controls across security, availability, and confidentiality trust service criteria.
UK GDPRCompliant
Aliena AI is operated from the UK and complies with UK GDPR. We act as a data processor for your organisation's project data.
05
Responsible Disclosure
If you discover a security vulnerability in Aliena AI, please report it to us responsibly. Do not exploit vulnerabilities or access data that does not belong to you.
Report tosecurity@aliena.co.uk
Response timeWe aim to acknowledge all reports within 48 hours.
What to includeDescription of the issue, steps to reproduce, and potential impact.
Our commitmentInvestigating all reports promptly, keeping you informed, and not taking legal action against good-faith researchers.
Last updated: March 2026