Trust pack
InfoSec should not wait on a PDF. Hosting, isolation, AI, tickets, and an honest SOC 2 status — public, dated by the page, no fake certification seals.
Longer narrative lives on Security. Legal: DPA, Privacy, Acceptable Use. Buying path: Enterprise.
Hosting
Vercel for the application. Supabase (Postgres, Auth, Realtime) for data. Optional OpenAI-compatible APIs only if the workspace operator sets a key. Optional email via Resend or SMTP. Optional PostHog on the marketing site.
Data
Workspace operator accounts (email). Probe payloads: error code, stack, endpoint, taxonomy, hashed or opaque developer identifiers, optional metadata the customer attaches. We do not want payment cards, health records, government IDs, or secrets in probes.
Identity
No. Identifiers are hashed. Clusters are failures and runtimes, not a CRM of people. Replay links point at the customer’s own PostHog or Mixpanel project.
Access
Postgres Row Level Security with is_org_member. Ingest uses org-scoped Bearer keys (aethel_live_…). Graph writes verify nodes belong to that org. Demo workspaces stay local until a real session.
Keys
Live ingest keys per organization. Eval-mode keys are time-boxed for sales PoCs and can be revoked. Rotate from SDK setup. Treat them as production secrets.
Tickets
No. Drafts wait for a human. Connect with a token the customer controls. confirm:true creates the issue.
AI
Only if the operator sets OPENAI_API_KEY. Then summaries and inbox replies may go to that provider. If the key is absent, templates stay in-product.
Encryption
TLS on hosted paths. At-rest encryption is whatever Supabase and Vercel provide for the project. No customer-managed KMS on Starter/Growth/Scale. Enterprise can scope region or VPC on a contract.
SSO
Not self-serve. Enterprise contract: SSO, SCIM, audit export, custom taxonomy, named contact. Timeline is scoped on the call, not a hidden toggle.
SOC 2
No. A controls and evidence program is in progress. We will not put a fake seal on the site. Ask for the current control list on a security review call.
DPA
Yes. Public DPA at /legal/dpa. Enterprise can negotiate exhibits for subprocessors and region.
Retention
Workspace data lives until the customer deletes the workspace or we process a deletion request under the privacy policy. Enterprise can set a written retention window in the order form.
Incidents
security@aethellayer.com. Coordinated disclosure. Do not publish customer stacks as exploit PoCs.
Training
Yes. Eval-mode keys add a time-boxed probe bonus. Memory Graph stays locked until Growth+.
Early access
Paste npx --yes @aethellayer/sdk run -- false and read the drafted issue in your terminal. Book a call when you want the probe in your CLI.