Security at Aethve

You are trusting us with an inventory of every device, license and contract you own. Here is exactly how that data is protected.

Tenant isolation

Your data is separated from every other customer's at the database level, not just in application code.

Every record carries an organization id, and PostgreSQL row-level security filters every query against the signed-in user's organization.
Isolation is enforced by the database itself, so it holds even if an application-layer check is missed.
Policies are verified against the live database, not only in tests.

Access control

Five built-in roles — owner, admin, manager, IT staff and viewer — plus custom roles with their own permission sets.

Permissions are enforced twice: once in the API layer and again in row-level security, so a client cannot bypass the API to write directly.
An automated test asserts both layers agree, so the two can never drift apart.
Billing, ownership transfer and organization deletion are restricted to the owner.
Optional two-factor authentication (TOTP) via any authenticator app.

Data protection

Encrypted in transit and at rest, hosted in the EU.

TLS for all traffic; AES-256 encryption at rest on managed PostgreSQL.
Primary data is hosted in the EU (Frankfurt, eu-central-1).
Passwords are hashed and never stored in readable form.
Third-party integration credentials are held in a dedicated secrets vault, never in application tables.
Daily automated backups with point-in-time recovery.

Auditability

Who changed what, and when — retained and tamper-resistant.

Significant actions are recorded with actor, timestamp, IP address and the fields that changed.
Audit records are append-only for members: they cannot be edited or deleted from the application.
Every AI agent action is logged and requires explicit confirmation before it writes.

Privacy

GDPR-aligned by default, with consent required before any analytics.

No analytics or tracking cookies are set until you explicitly accept them; declining is remembered and clears any prior data.
Only cookies strictly necessary for signing in are set without consent.
You can export or delete your organization's data at any time.

Who processes data on our behalf.

Sub-processors, their purpose and data region
Provider	Purpose	Region
Supabase	Database, authentication and file storage	EU (Frankfurt)
Vercel	Application hosting and CDN	Global edge
Anthropic	AI agent (Claude)	US
Stripe	Subscription billing and payments	US / EU
Resend	Transactional email delivery	EU (Ireland)
PostHog	Product analytics (only with consent)	EU

Certifications

We would rather be straight with you than imply a badge we do not hold. Aethve is a young product: we are not SOC 2 or ISO 27001 certified today, and we will say so plainly until we are. The controls described above are implemented and in use now. If your procurement process requires a certification we do not yet have, talk to us — we would like to know what to prioritize.

Reporting a vulnerability

If you believe you have found a security issue, email security@aethve.app with the details and how to reproduce it. We will acknowledge within two business days. Please do not disclose publicly until we have had a chance to fix it — we will keep you updated and credit you if you would like.

Questions about data processing or a DPA? Read the privacy policy or email privacy@aethve.app.

Need a security review?

Send us your questionnaire or ask for a DPA. A real person will answer, and will say plainly where we are not yet.