Authenticated platform access
Private platform workflows require authenticated access. Authentication is enforced by the API rather than relying only on browser controls.
AETHELIS TRUST CENTER
Security and trust, documented clearly.
A centralized overview of Aethelis architecture, data handling, authentication, access controls, security practices, and operational safeguards for prospective customers and procurement teams.
Accuracy over badges.
Aethelis distinguishes controls that are implemented today from planned work. Independent certifications or assessments are not claimed unless they have actually been completed.
CONTROL STATUS
Implemented controls and ongoing work.
Status labels describe the current Aethelis platform rather than representing third-party certification.
Organization-scoped records
Authenticated customer records are retrieved within the organization associated with the authenticated principal.
Governed release decisions
Aethelis Gate provides an explicit policy-based decision point for generated dataset release workflows.
Provenance and lineage
Trust Passport and Lineage records preserve generation and version history to support traceability.
Durable artifact integrity checks
Vault records stored dataset artifacts with SHA-256 fingerprints and verifies the fingerprint when an artifact is loaded.
Production hardening
Security, operational controls, documentation, and deployment practices continue to be hardened as the platform develops.
ARCHITECTURE & DATA HANDLING
Designed around controlled service boundaries.
Browser
The browser interacts with Aethelis through defined API interfaces. Provider credentials and server-side secrets are not intentionally exposed to browser code.
API
Private API workflows authenticate the caller and apply organization context before accessing customer-scoped records.
Dataset records
Generation jobs, Trust Passports, Lineage, Gate decisions, Vault metadata, and Watch records preserve evidence about governed synthetic-data workflows.
Dataset artifacts
Vault provides durable storage for generated dataset artifacts. Artifact fingerprints are used to detect integrity mismatches during retrieval.
AUTHENTICATION & ACCESS
Private workflows require identity.
Authentication
Authenticated platform/API workflows use identity-backed credentials. Missing or invalid authentication is rejected by protected API routes.
Organization boundaries
Customer evidence used by authenticated Aethelis features is scoped using the organization identity established server-side.
Authorization
Platform permissions distinguish operations such as ordinary authenticated use and administrative management capabilities.
Public endpoints
Public-facing workflows such as sales inquiries and public product assistance are intentionally separated from private authenticated customer-data routes.
SECURITY PRACTICES
Defense across requests, records, and releases.
Request controls
Aethelis applies request-security controls including accepted content types, request-size protections, CORS restrictions, and security response headers.
Rate limiting
Selected public request paths include application-level rate limiting and abuse-resistant form controls.
Secret separation
Service credentials used by backend integrations are configured server-side rather than embedded in public frontend code.
Audit-oriented records
Aethelis maintains structured records across generation, provenance, governance, storage, and monitoring workflows.
PRIVACY & GOVERNANCE
Diagnostics support review. They are not certification.
Direct-identifier checks and internal privacy diagnostics provide engineering signals that can support review before release. These signals do not establish legal de-identification, regulatory compliance, privacy certification, or a guarantee of anonymity.
SERVICE PROVIDERS
Infrastructure dependencies are documented without overclaiming.
Google Cloud
Aethelis currently uses Google Cloud infrastructure for hosted application services and platform storage components.
Firebase
Firebase services are used for the hosted web experience and identity-related platform workflows.
OpenAI
Ask Aethelis uses a server-side AI provider integration. Provider credentials are not exposed to the browser.
Resend
Resend is used to deliver submitted Aethelis sales and Design Partner inquiries by email.
This section describes current service dependencies and is not a contractual subprocessor schedule. Deployment-specific requirements should be reviewed during commercial scoping.
AVAILABILITY
Operational maturity is still developing.
Aethelis is under active production hardening. A public historical uptime commitment or SLA is not claimed here unless one is separately established for a customer deployment.
RESPONSIBLE SECURITY CONTACT
Found a potential security issue?
Please report suspected vulnerabilities privately rather than publishing sensitive technical details.
ASSESSMENTS & CERTIFICATIONS
No unsupported certification claims.
This Trust Center does not claim SOC 2, ISO 27001, HIPAA certification, or another independent security/compliance certification unless Aethelis has actually completed the relevant assessment or certification and explicitly publishes it here.