Skip to content
AEVIONTrust · IP · Globus
☰
DemoExploreShopAuthQRightQSignBureauPlanetAwardsBankChessPricingAPI
← All plans
SECURITY & COMPLIANCE

Security & Compliance

AEVION was built with security in mind from day one. Customer data lives in isolated namespaces, encrypted with AES-256 at rest and TLS 1.3 in transit, and our security policies are published openly. The status of every compliance standard is listed below — we do not claim what has not been completed.

Certifications & compliance

•
SOC 2 Type II
Controls in place, audit not yet purchased
Security, Availability, Confidentiality
•
GDPR
Policy published, deletion on request works; no independent audit
EU General Data Protection Regulation
•
152-ФЗ
We do not provide data localisation in Russia — no compliance claimed
Federal Law on Personal Data (Russia)
•
PCI DSS
Card data never reaches us: payments are taken by Lemon Squeezy as merchant of record
Payment Card Industry Data Security Standard

6 layers of protection

Comprehensive protection at every layer — from code to hardware.

🔒
Data encryption
Data at rest is encrypted with AES-256. Data in transit is protected by TLS 1.3. Keys are stored in HSM-compatible vaults and rotated every 90 days. BYOK (Bring Your Own Key) is supported for Enterprise customers.
👤
Access control
Role-Based Access Control (RBAC) with granular, object-level permissions. MFA is mandatory for every account. SSO via SAML 2.0 / OIDC. The principle of least privilege applies to all service accounts.
📋
Audit & logging
An immutable audit log for every action in the system: who, when, from which IP, what changed. Logs are retained for at least 365 days. Export to SIEM (Splunk, Datadog, ELK) via webhook or S3.
🏗
Infrastructure
Multi-tenant infrastructure with strict namespace-level isolation. Kubernetes with network policies and pod security standards. Every image is scanned by Trivy and Snyk before deployment. Runtime protection via Falco.
♻
BCP / Disaster Recovery
RPO ≤ 1 hour, RTO ≤ 4 hours. Data replicated across 2+ availability zones. Daily backups with restore verification. DR drills run quarterly. Uptime SLA follows the published ladder (GET /api/quotas): Build 99.0%, Scale 99.5%, Enterprise 99.9%.
🛡
Secure development
OWASP Top-10 checks in CI. Static analysis (SonarQube, Semgrep) and DAST on staging. Mandatory security review for changes to auth, billing, and data-access layers. Weekly dependency audits.

Data residency

Choose a data storage region that matches your regulator's requirements.

RegionAvailable on plansNotes
🇪🇺EU (Frankfurt)DEFAULTFree, Lite, Medium, Pro, Full, MaxStandard region; policy published, no compliance audit
🇷🇺RU (Moscow)Lite, Medium, Pro, Full, Max, EnterpriseNo primary storage in Russia — 152-FZ not claimed
🇰🇿KZ (Almaty)EnterpriseWe do not provide data localisation in Kazakhstan
🏢Your VPCEnterpriseA dedicated perimeter is discussed individually; not provided today
BUG BOUNTY

Found a vulnerability? We pay for it.

Our Bug Bounty program is open to everyone. Rewards up to $5,000 for critical vulnerabilities (RCE, SQL injection, data leaks, authentication bypass). We respond within 48 hours. Responsible disclosure is mandatory.

Request security documents

Documents are provided to current and prospective customers on paid plans and Enterprise.

SOC 2 — current status
Controls are in place, the independent Type II audit has NOT been completed — so there is no report to share. We keep the status on this page up to date.
See status
Data Processing Agreement (DPA)
Data Processing Agreement (GDPR Article 28). Signed electronically, timelines agreed with you.
Get DPA
Penetration Test Summary
A summary report of the annual penetration test performed by an independent firm. Available for Business and Enterprise.
Request pentest summary
← Back to plans
Questions? data@aevion.app

Apps and prices