The Platform That Survives Your Security Questionnaire.
Every vendor pitch promises compliance. Most can't show you the evidence. Aeion ships SOC 2 Type II, HIPAA-Ready, GDPR-compliant, and PCI-DSS Level 1 capabilities natively — not as a separate audit cycle. Immutable audit log on every write. Customer-managed encryption keys. Aegis backups with S3 object-lock for ransomware defense. AI tools that respect the same RBAC as your admin UI. The answers your auditor is about to ask for, ready before they ask.
The Native Security Surface
Immutable Audit Log
Every write to every collection generates a permanent, append-only record — who did it, what changed, before and after, traced end-to-end through the request. Nothing can be edited or deleted after the fact, even by an admin. SIEM-exportable to Splunk / Datadog / Elastic. Read Auth →
Aegis 4-Layer Data Protection
Phase 0 pre-destructive migration guard refuses dangerous schema changes. Phase 1 logical pg_dump snapshots to BYOB S3. Phase 2 continuous PITR ~30s RPO via pgBackRest. Phase 3 application-level time-travel with per-doc version history. Phase 4 weekly automated verification + monthly compliance reports. Read Aegis →
Customer-Managed Keys (CMK)
Files, AI provider credentials, payment processor secrets, encryption-at-rest — all support customer-managed AES-256 keys. Even Aeion staff cannot decrypt your tenant data without authorization. KMS integration included at no extra cost.
Role-Based AI Governance
AeionClaw runs under the calling user's RBAC. AI tools call platform APIs scoped by user role. The LLM never sees data the user couldn't already see. Every AI action logged with prompt + response + tool calls + diff. WebMCP enforces user-scope on browser-side tools.
Zero-Trust Architecture
No service-account-style auth between modules. Every request carries user identity. Every collection access goes through the 3-stage RBAC engine (pre-query row filter + post-read field mask + pre-write validation). No "internal services" trust assumptions.
PHI / PII / PCI Detection
Files module auto-scans uploads for PHI, PII, PCI, and secrets (API keys, JWT tokens, AWS access keys). Detection routes to quarantine + admin alert. Configurable redaction for non-authorized roles.
Sentinel Threat Detection
Cross-module event correlation (auth failures + permission violations + abnormal query patterns) feeds the Neural Bus for autonomous remediation. Brute-force attempts get IP-blocked, session-revoked, and admin-notified within seconds — without human intervention.
GDPR / CCPA Right-to-be-Forgotten
Native data export + erasure flows through Auth + Files + Collections. One API call exports a user's complete data in machine-readable format; another irreversibly anonymizes everything (preserving audit log integrity).
The Audit Story — What Your Auditor Actually Sees
Vendors talk about "audit logs." Auditors want to see specific events with specific fields. Every entry in Aeion's audit trail carries the same complete picture: who (user, role, session, IP, and device), what (the action taken, the exact collection and record affected, and a before/after diff of only the fields that changed), when (a precise, time-sortable timestamp), and the full request trace linking it back through the stack. High-risk actions also carry a user-supplied reason and, where required, the full approval chain. When AI took the action instead of a human, that's flagged explicitly, along with which skill ran and the prompt that triggered it — so "did a person or an AI do this" is never a guessing game.
Auditor questions that get answered in one query, not a week of log-scraping:
- "Show all logins from new IPs in the last 30 days."
- "Show all PHI access by user X."
- "Show all AI-initiated writes."
- "Show all permission-denial events."
The audit log is append-only at the database level — no update or delete permission exists, even for admins. Off-machine copies flow through Aegis backups automatically, and SIEM exports stream continuously at the Enterprise tier.
How Aeion Maps to Your Compliance Framework
Side-by-side mapping for the four most-requested certifications.
SOC 2 Type II (Trust Services Criteria):
- CC6.1 Logical access → Auth scoped RBAC + MFA + session timeouts + immutable login history
- CC6.6 Multi-factor → TOTP + WebAuthn FIDO2 + SMS fallback (Connect module integration)
- CC7.1 Security incidents → Neural Bus auto-detection + Sentinel reactions + audit trail
- CC7.2 Anomalies → Neural Bus pattern detection across modules with AI correlation
- A1.2 Capacity / availability → Aegis 4-layer backup + PITR + verification reports
HIPAA Security Rule:
- §164.308(a)(1) Risk Analysis → Sentinel + Aegis verification + monthly compliance PDF
- §164.308(a)(3) Workforce Security → Auth role-based access + required MFA
- §164.308(a)(7) Contingency Plan → Aegis Phase 2 PITR + Phase 1 backups
- §164.312(a) Access Control → Auth + collection-level access functions
- §164.312(b) Audit Controls → immutable audit log on all data access
- §164.312(c) Integrity → Aegis backup verification + per-doc version history
- §164.312(d) Person/Entity Auth → Auth MFA enforcement + per-role policy
- §164.312(e) Transmission Security → TLS 1.3 enforced everywhere
GDPR (relevant articles):
- Article 5 Principles → tenant data isolation + purpose limitation in Auth scopes
- Article 25 Data Protection by Design → Aeion's collection-access engine is privacy-by-default
- Article 30 Records of Processing → the audit log is your records-of-processing register
- Article 32 Security of Processing → CMK encryption + Aegis + MFA + audit
- Article 33 Breach Notification → Sentinel + Neural Bus auto-detect + 72h timer
- Article 17 Right to Erasure → native user-erasure API with audit-preserving anonymization
PCI-DSS (where applicable):
- Req 3 Protect cardholder data → no card data in Aeion DB; Stripe/Adyen tokenization
- Req 8 User identification → Auth MFA + per-role access
- Req 10 Track and monitor → immutable audit log
- Req 11 Test security → Aegis weekly verification + quarterly penetration test (Enterprise)
The mappings come with evidence lines — not just feature claims. Your compliance officer downloads the monthly Aegis compliance report and submits to your auditor.
The CISO Wins Beyond the Audit
Per-tenant cost caps
AI spend can't be exfiltrated via a compromised credential — the per-tenant limit applies even to a stolen API key.
Break-glass workflow
High-risk actions like mass delete, role elevation, or data export require approval and a documented justification before they run.
Pre-destructive migration guard
Refuses any schema migration that would drop a non-empty table — a safeguard built directly from real production incident experience, not a theoretical control.
AI tool execution under user RBAC
A compromised LLM prompt cannot access data the calling user couldn't already see.
Encrypted credentials at rest
Provider keys, customer secrets, and payment processor credentials are all encrypted with rotatable keys.
No service-account auth between modules
Zero-trust enforced — every cross-module call carries user identity.
Sentinel cross-module correlation
Coordinated credential-stuffing across Auth, Helpdesk, and Connect gets detected within seconds.
Singularity reverse-flow
Instant data export to your own bucket if you ever need to leave Aeion.
AI Governance — What Stops Your AI From Going Rogue
Every CISO's nightmare scenario is an LLM accidentally exfiltrating customer data through an over-permissive prompt. Aeion's AI architecture makes this structurally hard.
Three guardrails enforced at the platform level, below the application code:
- RBAC scoping: AeionClaw runs every tool call under the calling user's identity. The LLM can read what the user can read. A "Viewer" role cannot be tricked into a destructive write because the underlying tool call goes through the same 3-stage RBAC engine that protects the admin UI.
- Tool catalog restriction: Skills are versioned, signed, and individually toggle-able per role. Your security team curates which skills are allowed for which roles. Custom skills go through the Skill Factory's draft → sandbox test → admin approval → global deployment lifecycle.
- Per-tenant cost caps + rate limits: A prompt-injection attack can't trigger unbounded AI spend. Hard cost caps reject new calls once a tenant hits 100% of its configured budget. Rate limits, configurable per role and per skill, prevent burst-attack patterns.
Three audit guarantees:
- Every prompt + response logged. With tool calls + diffs + cost.
- Every tool call attributed. The audit entry is flagged as AI-initiated and includes the skill and prompt that triggered the action.
- Every approval recorded. High-risk AI actions surface approval requests; both the request and the response live in the audit log.
The AI is never the trust boundary. The user is. The AI is just a faster, more capable way to do what that user could already do.
CISO questions
Your tenant database (BYO Postgres or Aeion-managed), your S3 bucket (BYOB), your VPS or cloud account. Aeion is the processor; you remain the data controller. CMK encryption means Aeion staff cannot decrypt without authorization.
Neural Bus auto-detects anomalies (auth failures, permission violations, abnormal query patterns) and emits events. Sentinel module dispatches automated remediations (IP-block, session-revoke, MFA-challenge). Severity-tiered notifications fan out to email + Slack + PagerDuty. Documented runbook at /docs/security/incident-response.
Yes — Enterprise tier supports fully air-gapped deployment with no internet egress. On-prem AI inference via Ollama / vLLM / HuggingFace TGI. No telemetry. No outbound calls. Periodic update bundles delivered via your approved channel.
Aeion notifies affected tenants within 72 hours of confirmed incident, per GDPR Article 33. Notification includes incident scope, affected data categories, remediation actions, contact for further questions. Notification template + workflow ships with the Governance module.
SOC 2 Type II audit annually. Continuous compliance monitoring via Drata. Independent penetration testing quarterly (Enterprise customers receive reports). Vulnerability disclosure program at /security. Bug bounty program (paid). All employees background-checked + privileged-access-managed.
Yes — under NDA. Request via the security questionnaire form or directly via /contact?topic=soc2. We share the full Type II report with prospects in active evaluation.
Aeion tracks DORA (financial-sector resilience), EU AI Act (transparency + accountability), and NIST AI Risk Management Framework. Our AI governance + audit + RBAC architecture maps cleanly to all three. Specific control mappings available on request.
Yes — Enterprise tier supports per-region tenant deployment. EU tenants stay in EU infrastructure. APAC tenants in APAC. Cross-region replication is opt-in, not default. Data residency policies are enforced at the platform's core data layer, not just by configuration.
Required annual security training for all Aeion staff. Privileged access reviewed quarterly. Production access requires MFA + secondary approval. All deploy actions logged + reviewed in retrospective.