Security at Aethve

Tenant isolation

Your data is separated from every other customer's at the database level, not just in application code.

• Every record carries an organization id, and PostgreSQL row-level security filters every query against the signed-in user's organization.
• Isolation is enforced by the database itself, so it holds even if an application-layer check is missed.
• Policies are verified against the live database, not only in tests.

Access control

Five built-in roles — owner, admin, manager, IT staff and viewer — plus custom roles with their own permission sets.

• Permissions are enforced twice: once in the API layer and again in row-level security, so a client cannot bypass the API to write directly.
• An automated test asserts both layers agree, so the two can never drift apart.
• Billing, ownership transfer and organization deletion are restricted to the owner.
• Optional two-factor authentication (TOTP) via any authenticator app.

Data protection

Encrypted in transit and at rest, hosted in the EU.

• TLS for all traffic; AES-256 encryption at rest on managed PostgreSQL.
• Primary data is hosted in the EU (Frankfurt, eu-central-1).
• Passwords are hashed and never stored in readable form.
• Third-party integration credentials are held in a dedicated secrets vault, never in application tables.
• Daily automated backups with point-in-time recovery.

Auditability

Who changed what, and when — retained and tamper-resistant.

• Significant actions are recorded with actor, timestamp, IP address and the fields that changed.
• Audit records are append-only for members: they cannot be edited or deleted from the application.
• Every AI agent action is logged and requires explicit confirmation before it writes.

Privacy

GDPR-aligned by default, with consent required before any analytics.

• No analytics or tracking cookies are set until you explicitly accept them; declining is remembered and clears any prior data.
• Only cookies strictly necessary for signing in are set without consent.
• You can export or delete your organization's data at any time.

Sub-processors

The third parties that process data on our behalf.

Certifications

We would rather be straight with you than imply a badge we do not hold. Aethve is a young product: we are not SOC 2 or ISO 27001 certified today, and we will say so plainly until we are. The controls described above are implemented and in use now. If your procurement process requires a certification we do not yet have, talk to us — we would like to know what to prioritize.

Reporting a vulnerability

If you believe you have found a security issue, email security@aethve.app with the details and how to reproduce it. We will acknowledge within two business days. Please do not disclose publicly until we have had a chance to fix it — we will keep you updated and credit you if you would like.

Questions about data processing or a DPA? Read the privacy policy or email privacy@aethve.app.