How we protect your data

Data location

All customer data is processed and stored in the AWS eu-central-1 region (Frankfurt). Backups are stored encrypted in a second EU region. Processing outside the EU only happens if you enable an AI model outside the EU yourself. Our contract with AWS runs through its European entity: Amazon Web Services EMEA SARL in Luxembourg.

• Primary region: eu-central-1 (Frankfurt)
• Backups: second EU region, plus a copy in long-term storage
• Region and partition are parameters in the infrastructure code

Tenant isolation

Every customer environment has its own database with its own database user, its own S3 bucket and its own KMS key. Application containers run with CPU and memory limits. Large customers get their own application stack, their own database instance and their own network segment; a dedicated AWS account is optional.

Key management and crypto-shredding

Data at rest is encrypted with AES-256 via AWS KMS, with a customer managed key per customer. On exit, that key is destroyed after the retention period, rendering all backups and previous versions unreadable as well.

Encryption in transit

All traffic uses TLS 1.2 or higher, with HSTS. Databases and storage are not directly reachable from the internet; files are transferred through short-lived signed URLs.

Identity and authentication

One central identity provider based on OpenID Connect. Customer environments, browser tools, desktop apps and APIs trust this provider; local passwords on customer environments are disabled, except for a break-glass admin account.

• MFA with TOTP or passkeys (WebAuthn), enforceable per environment
• Desktop and browser tools: OAuth 2.0 Authorization Code with PKCE
• Short-lived JWT access tokens (15 minutes) with refresh tokens
• Revoking an account blocks new tokens immediately; active tokens expire within 15 minutes

Authorisation

Roles and permissions are managed per customer environment (role-based access control). Users are provisioned just in time based on their membership. Guests only see what has been explicitly shared with them.

External sharing

Share links are tokens with an expiry date and an optional password, and can be revoked at any time.

• Downloads via short-lived presigned URLs
• Recipients do not need an account
• Collaborating does require a (free) guest account

Support access

Staff have no access to customer data by default. Access is just in time: only with the customer's consent, time-boxed and fully recorded.

• Consent by the customer administrator, for 24 hours or 7 days
• Audit log of every session, visible to the customer
• Break-glass only for an outage or incident, with a reason and immediate notification

AI gateway

All AI requests pass through our own gateway, which enforces authentication, model selection, usage and limits. By default only models in the EU are used; models outside the EU must be enabled explicitly and are labelled. Customer data is not used to train models.

• Model policy per environment; 'EU only' can be enforced
• Budgets and limits per person and per environment, even without a live connection to the admin environment
• Usage metered per request

Permission-aware retrieval

The search index (pgvector) belongs to the customer environment and follows the same permissions as the apps: retrieval only returns documents the user is allowed to open. Conversation history is stored in the customer environment.

Infrastructure as code

The entire infrastructure is defined in OpenTofu and deployed through CI/CD; there are no manual console operations. The component that changes infrastructure has a narrow IAM role (least privilege); the application layer has no broad cloud permissions.

Backup and recovery

Backups are created automatically and periodically restored automatically to verify they work. An extra copy is kept in long-term storage (Glacier Deep Archive), encrypted with the customer's key.

Availability and service credit

We measure the availability of every environment per month. What we commit to depends on the service level. If we miss a commitment, you receive service credit: a discount on the monthly fee. Planned maintenance announced at least 5 working days in advance does not count.

• Basic: 99.5% as a target
• Business: 99.9% committed; 5% service credit per 0.1% below, up to 25%
• Premium: 99.95% committed; 10% service credit per 0.05% below, up to 50%

Monitoring and logging

Systems are monitored continuously with alerting. Administrative and support actions are recorded in audit logs. Usage and costs are metered per customer via tags. Support and follow-up during office hours.

Email security

Outbound email is sent via Amazon SES from the customer's domain, with SPF, DKIM and DMARC. Bounces and complaints are fed back per customer.

GDPR and data processing agreement

OpenAEC Studio BV is a processor within the meaning of the GDPR. Every subscription includes a data processing agreement with the list of sub-processors, including AWS (EU regions).

Incident response

If a security incident affects personal data, we inform the customer without undue delay about its nature, scope and measures, so the customer can report within the GDPR deadline.

Coordinated disclosure

Report vulnerabilities to the address below. We acknowledge receipt, keep you informed of the handling and are happy to credit you after publication.

maarten@open-aec.com

Exit and data portability

Full export at any time, in open formats: files with folder structure, data as CSV and a full database dump.

• Cancellation at the end of the month
• 30 days read-only for export
• 30 days frozen
• Destruction of the KMS key and a statement of deletion

Open source

All software on the SuperCloud is open source. You can audit the implementation yourself or have it audited, without relying on our statements.

On-premises

The same container images also run on-premises or at your own hosting provider if you want to keep your data entirely under your own control. OpenAEC Studio BV supports installation, operations and updates.