Trust Center

Last updated: October 30, 2026 · How AOSTRAC protects your data and earns your trust.

AOSTRAC is an AI operational layer for your organization. That position of trust is the product: we describe here, specifically, what protects your data — not vague claims.

Security

Encryption

Data in transit is protected with TLS. Integration credentials are encrypted at rest (Fernet/AES); the application refuses to start in production without an encryption key.

Tenant isolation

Every organization's data is separated at the API layer: access is restricted to a user's own workspace, tenant isolation is enforced on every workspace request, and cross-workspace access is covered by automated tests.

Human control

AOSTRAC never executes consequential actions on AI output alone. Recommendations require explicit human approval, every action is validated before execution, and every decision is written to a tamper-evident audit log.

Authentication

Passwords are stored as one-way hashes. Failed-login monitoring and brute-force alerting are built in, and sessions expire automatically. Google sign-in is supported today; single sign-on (SSO/SAML) is on our Enterprise roadmap and is not currently available.

Privacy

Your workspace data is yours. We process it only to operate AOSTRAC for you. AI provider calls carry only the minimum operational context needed — never your credentials, which are never placed in AI prompts. See the Privacy Policy for details, including your rights to export and delete your data.

AI safety

No silent autonomy

The AI proposes; humans dispose. Low-risk reads may run automatically, but anything that changes your operations needs approval.

Evidence over claims

AI answers distinguish fact from inference from recommendation, cite their sources, and say when data is missing — instead of inventing it.

Injection defense

External content (uploads, meeting transcripts, documents) is treated as untrusted data, never as instructions. Safety checks run between model output and any proposed action.

Compliance roadmap

We are building toward recognized standards — SOC 2, ISO 27001, and GDPR-aligned data handling — and will publish evidence as it is independently achieved. We do not claim any certification we have not earned.

Incident response

Security incidents are classified (P0–P3) and handled through a documented runbook: detection → containment → investigation → remediation → recovery → customer communication → post-incident review. If we ever need to tell you something about the safety of your data, we will — directly and promptly.

Availability & status

We monitor application health continuously. A public status page is planned; until then, reach us at the contact below for any availability concern.

Contact

Security issues: aostracsupport@gmail.com (please use the subject “Security”). General support: aostracsupport@gmail.com. We welcome responsible disclosure and will acknowledge reports promptly.