Security practices and review boundary

Scope and shared responsibility

AuraOne security depends on the selected product, deployment, customer environment, data classes, identity model, providers, and governing agreement. Customer and AuraOne responsibilities are documented during architecture and security review.

Public descriptions state a control area and review boundary. They do not assert that every control or configuration applies to every environment.

Identity and access

Identity, authentication, authorization, service accounts, privileged actions, and offboarding are scoped to the deployment. Access should follow least privilege and separation of responsibilities appropriate to the workflow.

• Human and service identity inventory
• Role and permission boundaries
• Privileged access and approval records
• Credential rotation and offboarding

Data protection

Data classification, ingress, processing, storage, retention, export, deletion, encryption, region, and transfer assumptions are documented for the actual program.

Restricted source material should move only through approved product and support paths. Public forms must not contain credentials, private datasets, protected health information, or other customer-confidential content.

Application and change security

Application review covers source changes, dependencies, secrets, tests, deployment approval, rollback, vulnerability handling, and retained operational evidence.

• Change review and protected delivery paths
• Dependency and vulnerability management
• Secret-management and configuration review
• Release approval and rollback evidence

Monitoring, recovery, and incidents

Logs, metrics, traces, audit events, alerts, backup, restore, recovery, and incident handling are selected for the product and environment. Monitoring should preserve useful evidence without exposing restricted source content.

Customer communication, support coverage, response timing, recovery objectives, and notification duties are defined by the governing agreement and incident context.

Framework and procurement posture

AuraOne's public posture does not claim SOC 2 certification or Type II attestation. Security, availability, and confidentiality materials are scoped for buyer review, and any current report is shared through the security review process.

AuraOne's public posture does not claim formal HIPAA compliance. Administrative, technical, and physical safeguards are scoped for sensitive-data workflows, and regulated responsibilities are established during procurement.

AuraOne's public posture does not claim formal GDPR compliance. Data processing, regional scope, transfer, and request-support responsibilities are established through buyer review and executed program documents.

AuraOne's public posture includes ISO 27001 as a control-mapping and buyer-review topic. AuraOne does not claim ISO 27001 certification; certification status, certificate, scope, and dates would be established by current verified evidence.

Open the compliance posture page for the current public framework labels.

Report a security issue

Use the contact route to request a secure disclosure channel. Include a high-level description, affected product or route, observed impact, and safe contact details. Do not place exploit instructions, credentials, private data, or customer identifiers in the public form.

Request a security disclosure channel

Change history