Credentials and secrets
Passwords use Argon2. Secrets you store are encrypted at rest with a key derived from the application secret, which does not live in the database — a database dump on its own yields nothing useful.
The encryption key can be rotated, re-encrypting all existing content.
Sessions
Sessions live in an httpOnly cookie, unreachable from JavaScript. Each user has a token version counter: changing your password or signing out everywhere immediately invalidates every open session, without waiting for expiry.
TOTP second factor is available on every plan.
Isolation between organizations
Every resource — conversation, usage, billing, scope — belongs to an organization, and the user's membership is verified before any query. Not a code convention: the shape of the tables.
Running probes
Active traffic against targets leaves the agent you install in your own infrastructure, never ours. Our servers receive the observed result; they do not run the probe.
Logging and audit
Sign-in, failed sign-in, invite, role change and credit grant become append-only records with IP and user agent. The trail survives deletion of the user who generated it.
What we do not have yet
We are honest about the stage: we do not hold SOC 2 or ISO 27001 certification, and we do not offer configurable data residency. If your procurement process requires any of those, talk to us before signing — we would rather say no than promise what we do not deliver.
Responsible disclosure
Found a flaw in Aethros? Write to security@aethros.io. We acknowledge receipt within 48 business hours and take no legal action against good-faith research conducted under this policy.