Security

The substantive data your organisation enters into Alethexis is stored on infrastructure hosted in the European Union (Frankfurt, region eu-central-1). Your AI systems inventory, your risk classifications, your assessments and your evidence stay in the EU.

Ancillary services (payments, transactional email, error monitoring) operate as subprocessors with their own safeguards; any international transfer is handled in accordance with the GDPR. The full, up-to-date list is published in our subprocessor register.

Alethexis is a multi-tenant platform: several customers share infrastructure, but never data. Isolation is enforced at database level through mandatory Row Level Security (RLS) on every table that holds customer data. No query can return one organisation's information to a user of another.

What sets us apart is that this isolation is not left to manual review: the RLS tests run in continuous integration and block the deployment if they fail. A version of Alethexis that compromises isolation between customers does not reach production.

All communication with Alethexis travels encrypted with TLS 1.3. Data at rest is encrypted with AES-256, both in the database and in file storage. The encryption keys at rest are managed by the infrastructure provider.

Access to data is governed by the principle of least privilege. Each customer account defines distinct roles — Owner, AI Officer, DPO, Contributor, Auditor — with permissions scoped to what each function needs.

Passwords are stored with bcrypt hashing; never in plain text. Sign-in supports multi-factor authentication (MFA), and credentials with internal Alethexis administration privileges have it enabled as a requirement. Service keys are never exposed to the browser: they are used exclusively server-side.

Sensitive operations on data are recorded in an audit log designed so that it cannot be altered: it is append-only and has modification and deletion permissions revoked at database level. Once written, a record cannot be edited or deleted.

This is the foundation of what we offer our customers — auditable and traceable evidence — applied to our own operation.

The database has Point-in-Time Recovery and backups with continuous 30-day retention. Restore capability is tested periodically in a separate environment, so that the backup is real and not merely theoretical.

Software dependencies are monitored automatically to detect known vulnerabilities, with continuous alerts on new threats. Critical patches are applied as a priority, within a target window of 72 hours.

When you contract Alethexis, we act as processor in respect of the data you enter, under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. We maintain a public, up-to-date list of subprocessors, and we give advance notice of any addition.

Today that list names eight subprocessors that process customer data — Supabase, Vercel, Cloudflare, Stripe, Resend, Google Workspace, Holded and Sentry — and, for each one, its purpose, the data involved, where it operates and the safeguard that covers it; it also lists two internal providers with no access to customer data, GitHub and Anthropic. The detail is in the subprocessor register.

Documents available:

• Privacy Policy
• Data Processing Agreement (DPA)
• Subprocessor register
• Cookie Policy

We have a documented security incident response procedure. In the event of a personal data breach that requires it, we notify in accordance with the GDPR deadlines (Art. 33). We review our technical and organisational measures periodically, and we update this page when there are material changes.

If you have identified a possible vulnerability in Alethexis, we want to know. Write to us at [email protected] and we will review it with the seriousness it deserves. We appreciate responsible and coordinated disclosure.