Security

Controls we have actually implemented.

This page describes the prototype as it exists today. It contains no certification claims. aeax holds no SOC 2, ISO 27001 or PCI attestation, and has not completed a third-party audit or penetration test.

Row-level authorisation

Every application, decision run and capital attestation is protected by database row-level security. Applicants read only their own records; staff access requires an explicit role row in a separate roles table.

Server-controlled underwriting results

Scores, decisions, risk bands and offers cannot be written by a client. Applicants may edit their own descriptive fields only; underwriting outputs are computed and written server-side.

Append-only decision ledger

Decision runs can be inserted and read by their owner but not updated or deleted through the application. Corrections are made by recording a new run linked to its parent.

Server-side recomputation

The browser preview is convenience only. On submit, inputs are re-validated and the decision is recomputed on the server before anything is persisted.

Bounded input validation

Every amount, string and identifier crossing the server boundary is schema-validated with explicit type, length and range bounds.

No third-party credentials in the browser

External API configuration is server-only. The public Kiva discovery calls run server-side and require no credential.

Authentication

Email magic-link and email/password sign-in with password reset, plus optional Google sign-in. Sessions are managed by the authentication provider; sign-out clears cached data.

Transport security

All traffic is served over HTTPS, and data at rest is stored in the managed Postgres backend provided by our hosting platform.

To report a vulnerability, contact the founder directly through the company page. We will acknowledge reports and describe remediation honestly.