Security at AEOLUS
AEOLUS handles your brand data, scan content, and — most sensitively — the API keys you bring. This page describes the controls that protect them.
Platform controls
Encryption in transit
All traffic is served over TLS. Security headers (CSP, HSTS via our edge, frame protections) are enforced by default.
Key vault — AES-256-GCM
Provider API keys are encrypted at rest with AES-256-GCM under a dedicated master key, shown only once at entry, and used solely to run the analyses you request.
Passwords & sessions
Passwords are stored as salted hashes, never in plaintext. A password reset revokes all API tokens and connector grants for the account, by design.
Role-based access control
Four roles (Viewer, Copy, Manager, Admin) gate every route server-side. Connector and API access can never exceed what the underlying user could do in the app.
OAuth 2.1 connector security
The MCP/API surface uses OAuth 2.1 with PKCE, scoped tokens (reports:read, work:write, scans:run, content:assist), hashed token storage, rate limiting, and one-click revocation.
Audit logging
Administrative and connector actions are written to an append-only audit log retained for up to 12 months.
Outbound-request guards
Server-side fetches used for scanning are SSRF-guarded: private networks and internal hosts are blocked in production.
Tenant isolation
Each organization's data is isolated by row-level access scoping enforced server-side on every query. Production and staging run as fully separate deployments, each with its own database, encryption key, and secrets.
Infrastructure
- Hosted on Railway (United States) with managed MySQL, automated backups, and health-checked deploys.
- Separate staging and production environments with independent databases and secrets.
- Secrets live in environment configuration — never in the code repository.
Data handling
- We do not sell data, run ads, or use third-party trackers; cookies are essential-only.
- Scan content is sent to the AI model providers you configure (or capped platform keys during a sponsored pilot) solely to run your analyses. We do not use your data to train models.
- Retention and deletion timelines are documented in the Privacy Policy; DPA available on request.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Railway | Hosting + managed MySQL | US |
| Resend | Transactional email | US |
| OpenRouter | LLM gateway (when configured) | US |
| Anthropic / OpenAI / Google / Perplexity / xAI | Model execution per your configuration | US |
| SerpApi | Google AI Overviews / AI Mode data (when configured) | US |
Compliance roadmap
SOC 2 Type I is on our near-term roadmap, with a compliance-automation platform and independent audit planned; we're happy to complete security questionnaires in the meantime. Ask us at hello@aeolus-cloud.com.
Responsible disclosure
If you believe you've found a vulnerability, email security@aeolus-cloud.com with reproduction steps. Please give us a reasonable window to remediate before public disclosure; we won't pursue good-faith research conducted within these guidelines.