AERANDIL
Design partners
ForgeProximaLabsTalosAgent StudioIthacaMeridianPaymentsDocsCompanyBlogDesign partners
Trust & security

Security is the architecture.

Aerandil holds guest data, folios, and operational records for the businesses that run on it. The controls that protect them aren't bolted on — append-only audit, forced tenant isolation, regional residency, and governed change are how the platform is built.

Read the security whitepaperSee the controls
Core security properties
Append-only audit
Tenant-isolated
EU · UK · US residency
GDPR erasure
Where we are

Early on certificates. Not on architecture.

Aerandil is pre-certification, and we say so plainly. SOC 2 is in progress, not framed. What we're not early on is the engineering: every control below is shipped in code today — built on the open foundations the platform is made of, not promised on a slide. The certifications now underway attest to a design that is already here.

Controls, shippedNine domains
01 · Identity & access

Identity & access

EdDSA-signed access tokens with a published JWKS, OAuth 2.1 scopes issued least-privilege per integration, Argon2id-hashed secrets, and WorkOS-backed SSO/MFA for human operators.

  • EdDSA + JWKS
  • Scoped OAuth 2.1
  • WorkOS SSO / MFA
  • Argon2id

02 · Tenant isolation

Tenant isolation

Every tenant is fenced by Postgres row-level security — forced and fail-closed — over a dual-role connection model and tenant-covering keys. Isolation lives in the database, not just the application.

  • Forced RLS
  • Dual-role
  • Tenant-covering keys

03 · Data residency

Data residency

Aerandil pins each tenant to a region and enforces it at placement, relocation, and cell boot — built so EU data stays in the EU, UK in the UK, US in the US. A misplaced cell refuses to start.

  • EU · UK · US
  • Enforced at boot
  • Relocation-safe

04 · Audit & integrity

Audit & integrity

An append-only, immutable event log sits underneath every change; writes are idempotent and guarded by optimistic concurrency. The audit trail is the architecture, not a bolt-on.

  • Append-only events
  • Idempotent writes
  • Optimistic concurrency

05 · Data-subject rights

Data-subject rights

GDPR Article 17 erasure — per guest and whole-tenant — and Article 20 export are first-class endpoints, with per-type retention windows. Most platforms can't cleanly answer 'right to be forgotten'. Aerandil can.

  • Art 17 erasure
  • Art 20 export
  • Retention windows

06 · Encryption

Encryption

TLS is required in transit — rustls only, downgrade rejected. Encryption at rest is host-managed with customer-manageable KMS keys on certified cloud infrastructure.

  • TLS-required
  • At-rest KMS
  • rustls only

07 · Supply chain

Supply chain

Every release image is vulnerability-scanned, SBOM-generated, provenance-attested (SLSA), and keyless-signed with cosign. Every CI action is pinned by commit hash — no moving tags.

  • Signed images
  • SBOM + SLSA
  • SHA-pinned CI

08 · Observability

Observability

OpenTelemetry distributed tracing, around fifty cardinality-disciplined Prometheus metric families, and structured JSON logs give incident response full visibility — without leaking PII into telemetry.

  • OpenTelemetry
  • Prometheus
  • Structured logs

09 · Data classification & redaction

Data classification & redaction

Sensitive fields carry mandatory-access-control markings. Classified values are redacted from the immutable change log entirely, and the production read API returns them only to callers holding the matching clearance.

  • MAC markings
  • Change-log redaction
  • Clearance-gated reads

Compliance posture

Mapped to the frameworks buyers ask about.

A UK Ltd serving the UK, EU, and US. Our controls map to the standards procurement reviews run on — each one labelled honestly by where it stands.

SOC 2

In progress

Controls mapped to the Trust Services Criteria; Type 1 underway via continuous monitoring.

ISO 27001:2022

Aligned

Technical controls aligned to Annex A, mapped and maintained alongside the code.

UK GDPR · DPA 2018

Covered

UK-home posture under the ICO; a Data Processing Agreement is available to customers.

EU GDPR

Covered

Processor obligations, lawful-basis discipline, SCCs and an EU representative as we enter the market.

US privacy

Covered

CCPA / CPRA and the wider state patchwork, with SOC 2 as the procurement signal.

Cloud infrastructure

Inherited

Runs on SOC 2 / ISO 27001-certified cloud (AWS); physical and datacentre controls inherited from the host.

In progress

On the bench right now.

What we're actively building toward — listed here so the line between shipped and planned is never blurred.

  • SOC 2 Type 1 — continuous-monitoring rollout
  • Admission-time image verification — signature enforcement on the live cluster
For reviewers
Responsible disclosure

Found something?

We welcome coordinated disclosure. Report a vulnerability and we'll acknowledge it, keep you updated, and credit you once it's resolved.

security@aerandil.com
Data processing

DPA & data handling

A Data Processing Agreement, sub-processor list, and details on data residency and retention are available to customers and prospects under review.

Request the pack

Request a briefing

Bring your security
questionnaire.

Aerandil is in private development. The next milestone is working with design partners who operate complex, multi-system hospitality businesses.

Design partner channel coming soon.