Legal · Security
Security
Last updated · 2026-07-04
Aelo handles brand data. Here is what we do to keep it safe, described in operational terms rather than certification labels.
1. Data at rest
All customer data is stored in Supabase Postgres with database-level encryption. Backups are encrypted with rotating keys.
2. Data in transit
TLS 1.2+ everywhere. HSTS enforced on all origins. No plain-HTTP endpoints, in production or preview.
3. Row-Level Security
Every product table in Postgres has RLS policies scoped by organization. Users can only see rows in workspaces belonging to their organization, enforced at the database, not just the API.
4. Auth
- Supabase Auth with bcrypt-hashed passwords.
- OAuth via Google available.
- Sessions rotate on every login; JWTs are short-lived.
- Reset flows require email confirmation.
5. Sub-processor list
Supabase (Postgres, Auth, Storage) · Vercel (hosting, Cron) · Google (Gemini scans) · OpenAI, Anthropic, Perplexity (scans) · Resend (email) · Razorpay + Stripe (billing). We only send the minimum required data to each. Prompts sent to LLM providers do not include PII.
6. Vulnerability disclosure
Found something? Email security@aelohq.com. We reply within 48 hours and credit you on our security page if you want.
7. Compliance
GDPR-aligned data handling. DPA available on request. Formal SOC 2 in progress. Concierge tier customers get a full security review.