Security
How AERA handles your data.
We list only confirmed security measures. Anything not settled yet is labelled as such: “Being documented” or “Planned”.
In short
The essentials in a minute
- In place
What AERA can access
Only the data you connected yourself. Access keys to your systems are stored encrypted on the server and never reach the browser.
- Being documented
Where the data is stored
We will publish the storage country and region together with the privacy policy.
- Being documented
How to delete data
For now, on request in the Telegram bot. The process and timelines will be published later.
Protection
How the data is protected
Access keys to your systems and internal services are closed off from the browser and the internet.
- Access keys to your systems are stored only on the server, encrypted (AES-256-GCM).
- The AERA server accepts only secure connections (TLS).
- Webhook messages are verified with an HMAC-SHA256 signature over the request body and time. Messages older than 5 minutes are rejected.
- The PostgreSQL database cannot be reached from the internet.
- Programs on the server run with minimal rights and cannot change the system.
- The server accepts requests only from allowed addresses. Requests that are too large are rejected, and technical error details are not shown to outsiders.
Access
Who sees the data
A company’s data is visible only to its own people in AERA.
- Users of one company cannot see another company’s data.
- In the Windows app, the sign-in key is kept only in memory and erased when the app closes.
- The key for signing in again is kept in the Windows password vault.
Audit log
Change log
Important settings changes are recorded, and every number can be traced back to its source.
- Changes to connections, field matching and the choice of main data source are written to a log. Its entries cannot be changed or deleted.
- Every conclusion shows its source, period and calculation.
Storage
Data storage and deletion
- Being documented
Data storage region
We will publish it together with the privacy policy.
- Being documented
Retention periods
We will describe them for CRM data and account data before payments launch.
- Being documented
Data deletion
For now, on request in the Telegram bot. The process and timelines will be published later.
- Being documented
Backups
How often copies are made and how fast data can be restored will be described later. We make no promises yet.
AI
AI and your data
- In place
AERA’s formulas calculate the numbers
The AI does not query the database directly: numbers come only from AERA’s finished calculations.
- In place
No data, no conclusion
If there is not enough data, AERA says so plainly and does not make up a plausible answer.
- Being documented
AI and your data
Whether data is used to train AI models, and which data goes to which services, will be described here. Until then, we make no claims we cannot back up.
Updates
Updates and incidents
- In place
Checked updates
Every update goes through automatic checks and can be rolled back quickly.
- Being documented
Incident response process
It will be published later. You can already report a problem in the Telegram bot @aera_platform_bot.
- Planned
Public status page
Coming together with continuous monitoring.
Standards
Standards and certifications
“Not offered” means we do not have it right now. We will update the list when something changes.
| Measure | Status |
|---|---|
| Encryption of access keys to connected systems | In place |
| TLS for external connections | In place |
| Audit log of changes | In place |
| Different permissions for staff (RBAC) | Planned |
| Sign-in with a company account (SSO) | Not offered |
| Data processing agreement | Being documented |
| Guaranteed uptime (SLA) | Not offered |
| Certifications (SOC 2, ISO 27001) | Not offered |
Found a vulnerability or need a technical review? Message the support@aera-platform.ru.
Security
Connect your CRM with only the access it needs.
The access key to your system is stored encrypted on the AERA server and never reaches the browser.
Need help connecting? Contact support.