Security at Aexy
How we protect the data you trust us with.
Encryption everywhere
TLS 1.2+ in transit. AES-256 at rest. Secrets stored in a managed vault, never in code or config.
Least-privilege access
Production access is limited to a small on-call group, requires SSO + 2FA, and is audited.
Hardened infrastructure
Running on managed cloud platforms with private networking, automated patching, and isolated workspaces.
OAuth-first auth
Sign in with Google, Microsoft, or GitHub. SSO and SCIM available on Enterprise.
Compliance
We are working towards SOC 2 Type II certification. Until certification is complete, we're happy to share details of our controls and progress with prospective customers under NDA. Email [email protected].
Data isolation
Workspace data is logically isolated and queried only by authenticated requests bound to that workspace. Backups are encrypted and retained for a limited period. Enterprise customers can request private-cloud or VPC deployment.
Responsible disclosure
If you believe you've found a security issue, please email [email protected] with steps to reproduce. Please do not publicly disclose until we've had a reasonable opportunity to fix it (typically 90 days). We commit to acknowledging reports within two business days and to keeping you informed while we work on a fix.
Incident response
If a security incident affects your data, we'll notify the affected workspace owners as quickly as we have reliable information, and follow up with a written post-incident review.