Security, privacy and operational trust

Security architecture

• Enterprise identity with role-based access control
• Segregation of duties enforced in the workflow, not requested
• Tenant-scoped data isolation with row-level authorisation
• Encryption in transit and at rest
• Least-privilege service access and secret management
• Hardened transport security headers on every response
• Append-only audit history that cannot be silently edited
• Hashed evidence artefacts for integrity verification

Data handling and privacy

Customer data is processed only to deliver the service. AIRAS Cloud does not use customer content to train models. Data residency, retention and deletion positions are agreed contractually before onboarding, and pilots run on synthetic, de-identified or expressly approved data unless a prior privacy and security review says otherwise.

Our privacy notice sets out lawful basis, retention and the rights available to individuals whose data is processed through the service.

Operational controls

Product change moves through governed, versioned release process with review before deployment. Rulesets, policy packs and control libraries are versioned separately from code so a governance change is itself an auditable event.

Incidents are triaged against defined severity, with customer notification commitments set out in the applicable agreement.

Assurance status

We publish only what we can evidence. AIRAS Cloud maps its own operating controls to ISO/IEC 27001 and ISO/IEC 42001 themes and supports customer-led security reviews with a security pack, architecture detail and completed questionnaires. We do not claim certifications we do not hold.

Responsible disclosure

If you believe you have found a security issue, contact interest@airascloud.com with enough detail to reproduce it. We acknowledge reports, investigate promptly and will not pursue action against good-faith research that respects customer data and service availability.

Integration and onboarding documentation

The AIRAS Cloud Integration and Onboarding Gospel is written, tested and validated: a 45-page controlled technical manual covering procurement gates, contracting instruments, tenant provisioning and isolation, role-based access and SSO, evidence onboarding waves, the regulatory assessment sequence, security controls, environments and recovery, go-live criteria, the 90-day hypercare warranty and per-layer troubleshooting.

It is a confidential document issued under agreement rather than published, and is made available immediately to customers and to organisations in an active procurement or assurance review. Request it and we will issue the current controlled version.

Statement of integration readiness

AIRAS Cloud maintains a signed Statement of Integration Readiness covering tenant isolation, identity and access management, upload content safety, recoverability, service levels and the contractual position. Each line in it names the artefact that evidences it, and any item that is not complete is disclosed rather than implied.

The current version records enforced multi-factor authentication for privileged roles, a full member invitation and offboarding lifecycle with session revocation, SAML single sign-on configurable against your identity provider, a deterministic upload content-safety gate, documented backup and disaster recovery objectives, and a data processing agreement with a named sub-processor register. It is issued confidentially on request to customers and assurance reviewers.