8 questions your security team will ask — answered with specifics.
Last reviewed June 2026. Maintained by Aliax engineering. This is not an independent certification.
Authentication
Customer accounts are authenticated via Supabase Auth (email + password, Google OAuth). API access uses scoped, revocable API keys you create from the dashboard — never your account password.
Role data lives in a dedicated user_roles table behind a security-definer function; client code cannot grant itself privileges.
Authorization · least privilege
Every database table enables Row-Level Security. Policies scope reads and writes to auth.uid() by default. Service-role writes happen only inside signed webhook handlers and admin server functions, never from client code.
Infrastructure
The Aliax execution layer runs on Cloudflare Workers across 6 regions, Postgres (Supabase, us-east-1) for ledger and config, and R2/S3 for screenshot blobs (AES-256 server-side encryption at rest). Traffic terminates TLS at Cloudflare; origin is mTLS-locked.
Cloudflare Workers and Supabase (AWS) carry SOC 2 Type II and ISO 27001 attestations — inherited certificates available on request.
Enterprise customers can be provisioned a dedicated Worker route and a dedicated bucket with pinned region.
Data handling
We store: account email, hashed API keys, credit ledger entries, capture metadata, and the screenshots your SDK uploads. We do not sell, share, or train models on customer data.
PII in screenshots: pass redact_selectors=[...] (Python) / redactSelectors:[...] (Node) to the Aliax(...) constructor — DOM nodes matching those selectors are blurred client-side before the image leaves your runtime.
Retention
Screenshots are retained 30 days by default for replay and annotation, then purged. Enterprise accounts can set retention to as low as 24 hours. Ledger entries are append-only and retained for billing/audit purposes.
Account deletion purges all customer screenshots within 7 days.
Secrets
API keys are stored as SHA-256 hashes; the raw key is shown to you exactly once at creation. Webhook secrets (Paystack, Flutterwave) are HMAC-verified with timing-safe comparison before any side effect.
Compliance posture
Aliax does not hold its own SOC 2 or ISO 27001 certificate. We shadow SOC 2 Type II criteria (CC6 access control, CC7 change management, CC8 vendor review). Our cloud infrastructure inherits Cloudflare's and Supabase/AWS's SOC 2 Type II attestations.
Internal policy pack and Data Processing Addendum available under NDA for customers handling EU personal data. Sub-processor list lives on our privacy page.
Incident response
Confirmed incidents affecting customer data are disclosed to affected accounts within 72 hours of confirmation, including scope, root cause, and remediation. Status updates are posted to status.aliax.xyz during active incidents.
Contact: security@aliax.xyz
SOC 2 + ISO 27001 roadmap
shadow controls live · type i targeted q4 2026Aliax operates against SOC 2 Trust Services Criteria today and is on a published path to independent attestation. Inherited Cloudflare + Supabase/AWS evidence is available now under NDA.
CC6 / CC7 / CC8 shadow controls
Quarterly access reviews, signed change-management commits, vendor risk register. Internal evidence pack on request.
SOC 2 Type I
Auditor selected. Policy pack frozen Sep 2026. Point-in-time report ready Dec 2026.
SOC 2 Type II
12-month operating window. Report delivered to enterprise accounts under NDA.
ISO 27001 + DPA template
ISMS rolled out alongside Type II. Standard DPA + public sub-processor list.
Enterprise-ready answers, no hand-waving.
The questions procurement, security, and legal teams ask before they sign. If yours isn't here, mail enterprise@aliax.xyz.
Responsible disclosure
If you believe you've found a vulnerability, email security@aliax.xyz with reproduction steps. We acknowledge within 48 hours and aim to triage within 5 business days. Test only against accounts and resources you own or have written permission to test — do not run automated scans against production infrastructure.
security questionnaire + evidence pack
Internal policies (CC6 / CC7 / CC8), sub-processor list, Cloudflare + Supabase infrastructure certs, and pre-filled questionnaire responses — sent under NDA within 1 business day.