Security at Aulintri

Hosting

• Runs on Amazon Web Services (AWS) in the US East (N. Virginia) region.
• Application services run as managed containers on AWS ECS Fargate. There are no servers we patch by hand.
• The production database runs in two availability zones (Multi-AZ), with automatic failover.

Network isolation

• Production and development run in separate, unconnected private networks (VPCs).
• Only the load balancer is reachable from the internet, only over HTTPS, and behind a web application firewall (AWS WAF).
• Application servers accept traffic only from the load balancer. Databases accept traffic only from the application servers.
• Firewall rules (security groups) are reviewed at least once a year.

Encryption in transit

• All traffic is encrypted with TLS 1.2 or higher (TLS 1.3 supported).
• Plain HTTP requests are redirected to HTTPS.
• Connections from our application to the database and cache are encrypted too.

Encryption at rest

• The database, the cache and all backups are encrypted with AES-256.
• Uploaded documents and generated PDFs are stored in encrypted storage. Public access is blocked, and versioning protects against accidental deletion.
• Application secrets are kept in AWS Secrets Manager, never in source code.

Tenant isolation

• Each customer’s data is kept separate by row-level security inside the database. The database refuses a query that doesn’t carry a tenant context.
• Each customer workspace has its own address, and sign-in is refused at another tenant’s address.

Backups and recovery

• Automated daily backups of the production database, with point-in-time recovery for 30 days.
• Deletion protection is enabled on production databases.
• Current platform status: aulintri.com/status.

Customer sign-in

• A password alone never signs anyone in. Every sign-in needs a second factor: a one-time email code or an authenticator app (TOTP), with recovery codes.
• Strong password rules are enforced. Passwords are stored only as salted bcrypt hashes.
• Sign-in and other sensitive endpoints are rate-limited to slow brute-force attempts.

Permissions

• Role-based access control. Every action is checked against the user’s role and permissions on the server.
• Business administrators manage roles and users for their own organization.
• Security-relevant actions are recorded in an audit log.

Our team’s access

• Access to production systems is limited to the engineering staff who need it, on a least-privilege basis.
• Cloud access is role-based and separated by environment.
• Access is removed when someone leaves the team.

Logging and threat detection

• Every administrative action on our AWS accounts is logged to a separate log archive, with log-file integrity validation and write-once retention.
• AWS GuardDuty continuously monitors for suspicious activity, and its findings alert the engineering team.
• Network flow logs and firewall logs are kept for 90 days, and changes to network and data infrastructure are recorded in AWS Config.
• Health checks take a failing server out of service automatically.

Secure development

• Every change goes through a pull request with peer review and approval before it ships.
• Automated checks run on every change: linting, type checking, automated tests and a full build.
• Deployments run through an automated CI/CD pipeline.
• Container images are scanned for known vulnerabilities when built.

SOC 2

We run a formal security program with documented policies, and are working toward a SOC 2 report. Our controls are tracked continuously in Vanta. Contact us for details.

Report a vulnerability

If you believe you’ve found a security issue in Aulintri, email info@aulintri.com with the subject “Security vulnerability report”. Please don’t access or change other customers’ data, and give us reasonable time to fix the issue before disclosing it. We’ll confirm we’ve received your report.