Security

The product data your organisation enters into Alethexis is stored on infrastructure hosted in the European Union (Frankfurt, region eu-central-1). Your AI systems inventory, your risk classifications, your assessments and your evidence stay in the EU.

Ancillary services (payments, transactional email, invoicing) are provided by third parties with their own safeguards; any international transfer is handled in accordance with the GDPR. The role each one plays, and the safeguard that covers it, are published in our subprocessors and service providers register.

Alethexis is a multi-tenant platform: several customers share infrastructure, but never data. Isolation is enforced at database level through mandatory Row Level Security (RLS) on every table that holds customer data. No query can return one organisation's information to a user of another.

What sets us apart is that this isolation is not left to manual review: the RLS tests run in continuous integration and block the deployment if they fail. A version of Alethexis that compromises isolation between customers does not reach production.

All communication with Alethexis travels encrypted with TLS 1.3. Data at rest is encrypted with AES-256, both in the database and in file storage. The encryption keys at rest are managed by the infrastructure provider.

Access to data is governed by the principle of least privilege. Each customer account defines distinct roles — Owner, AI Officer, DPO, Contributor, Auditor — with permissions scoped to what each function needs.

Passwords are stored with bcrypt hashing; never in plain text. Sign-in supports multi-factor authentication (MFA), and credentials with internal Alethexis administration privileges have it enabled as a requirement. Service keys are never exposed to the browser: they are used exclusively server-side.

Sensitive operations on data are recorded in an audit log that only allows entries to be added: modification and deletion permissions are revoked at database level. Once written, a record cannot be edited or deleted from the application; section 11 explains what would happen if someone tried to do so by another route, and how it would be detected.

This is the foundation of what we offer our customers — auditable and traceable evidence — applied to our own operation.

The database has daily backups managed by the infrastructure provider in the same European region, with a retention of seven days. Point-in-time recovery and periodic restore tests in a separate environment are on our security roadmap, and we do not present them as measures until they exist.

Software dependencies are updated automatically, and no change reaches production without review, type checking and required tests. Secret detection scans the entire code history on every integration.

When you contract Alethexis, we act as processor in respect of the data you enter, under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. We maintain a public, up-to-date list of subprocessors, and we give advance notice of any addition.

The public subprocessors and service providers register distinguishes three blocks according to each third party's role: the customer's subprocessors within the meaning of Art. 28 — the only ones covered by the 30-day advance notice and the right to object —, Alethexis's providers as controller, which do not receive customer substantive data, and development tools with no access to production data. For each one it states its purpose, the data involved, where it operates and the safeguard that covers it. The register is the source: any count or list that appears on another page is a summary that goes out of date.

Documents available:

• Privacy Policy
• Data Processing Agreement (DPA)
• Subprocessors and service providers register
• Cookie Policy

We have a documented security incident response procedure. In the event of a personal data breach that requires it, we notify in accordance with the GDPR deadlines (Art. 33). We review our technical and organisational measures periodically, and we update this page when there are material changes.

If you have identified a possible vulnerability in Alethexis, we want to know. Write to us at [email protected] and we will review it with the seriousness it deserves. We appreciate responsible and coordinated disclosure.

Your organisation's audit log cannot be modified or deleted from the application: it is append-only. Every entry carries a SHA-256 integrity hash chained to the previous one, so it is designed for any later alteration or deletion to be detected. Each organisation's chain is verified automatically every day, and the result is shown on the log itself. If an event could not be saved, the failure is logged and our team reviews it daily. As a general rule, we keep the log blocked for a maximum duration of five years from the end of the engagement, without prejudice to a different limitation period being applicable or to a legal cause interrupting or extending that period.

We do not say "immutable" or "impossible to alter". A database administrator could try; what we offer is that it would be detected. We would rather say exactly what we do: every day we export the chain heads to a store outside the database, with a different provider and a different access control, and we compare them the following day: a complete reconstruction of the log would be detected.

If a person is deactivated, their name disappears from everything they did in Alethexis, but what was done is kept: the systems they registered, the classifications, the approvals and the evidence are still there, with no visible author. In the audit log, their identifier, IP address and user agent are removed. IP addresses and user agents are always removed after 12 months. The rest of the information is kept according to a retention matrix by category and is deleted once its period ends.