Skip to content

Security

What protects your data, stated plainly

This page lists the controls that are verified today and the ones we are working towards. We do not claim certifications we have not earned.

Certifications. AATTRL does not currently hold SOC 2, ISO 27001 or any formal GDPR certification. We will publish evidence here if and when an audit is completed.

In place

Verified controls

  • Encryption in transit

    Infrastructure

    All traffic to the website and application is served over HTTPS with modern TLS.

  • Hardened browser security headers

    Infrastructure

    Content Security Policy, frame protection, referrer policy and permissions policy on every marketing page.

  • No card details stored by AATTRL

    Payments

    Payment details are handled by a third-party payment provider and never pass through or persist in AATTRL systems.

  • Marketing site separated from customer data

    Infrastructure

    The public website runs separately from the application and has no access to tenant records.

  • Privacy-respecting analytics

    Privacy

    Website analytics are cookieless and do not track visitors across sites.

Planned or pending verification

What we are working towards

These controls are part of the product design. They are listed here as planned until they have been implemented and verified.

  • Encryption at rest

    Planned

    Application databases and file storage are encrypted at rest by the hosting provider.

  • Role-based permissions

    Planned

    Workspace roles control who can view and edit customers, projects, documents and invoices.

  • Tenant isolation

    Planned

    Every query is scoped to the workspace; data from one organisation is never returned to another.

  • Permission-aware AI

    Planned

    The assistant answers only from records the requesting user is allowed to see and never trains models on workspace data.

  • Automated backups

    Planned

    Application data is backed up automatically with tested restore procedures.

  • Audit log

    Planned

    Significant actions are recorded with who did what and when.

  • Data export and deletion

    Planned

    Workspace owners can export their data and request deletion of their workspace.

  • Single sign-on

    Planned

    SAML/OIDC single sign-on for Enterprise workspaces.

Reporting a security issue

If you believe you have found a vulnerability in Enaivu or this website, email info@aattrl.com with the subject “Security report”. Please include steps to reproduce. We will acknowledge reports and keep you informed of progress. Please do not access data that is not yours or disrupt the service while testing.

Privacy

How we collect and use personal data is described in the privacy policy. It is written to be read, and it is reviewed before each material change to the product.