Security & data handling

Security is not a feature we bolt on at the end. It is the baseline every system we ship has to meet — whether we are building a workflow, an AI agent, or a customer portal. This page describes the protections we apply to our own operations and the standard we hold client systems to.

If you believe you have found a vulnerability in anything we operate, we want to hear from you first — details below.

• Least-privilege access — engineers get the minimum scoped access they need, for as long as they need it. Standing credentials are the exception, not the rule.
• Encryption in transit and at rest — TLS for everything on the wire; encrypted volumes and secrets management for anything stored.
• No secrets in code or config — credentials live in a vault, never in repositories, environment defaults, or client-side bundles.
• Audited tooling — third-party services are reviewed for their security posture before we connect them to client data.
• Regulated-team practices — we build the way a SOC2-aware team builds: redaction at the edge, RBAC, versioning, and audit trails as default behaviour, not add-ons.

For systems we build for clients:

• Data is processed under a written agreement that defines ownership, retention, and deletion.
• We instrument per-request access and keep audit trails of who or what touched what.
• Sensitive values are redacted at the edge — before they reach models, logs, or analytics.
• We ship rollback playbooks and monitoring so that a misbehaving change can be reversed quickly and safely.
• On exit, you retain every artifact — code, infrastructure, evals, and runbooks — and we revoke our access to your systems.

We take vulnerability reports seriously and respond without undue delay.

To report a security issue:

• Email security@aetherichq.com with as much detail as you safely can.
• Include the affected URL or system, a reproduction path, and your contact details (optional).
• Do not access, modify, or exfiltrate data beyond what is needed to demonstrate the issue, and do not disclose the finding publicly until we have had a chance to fix it.

• Acknowledgement — we confirm receipt within two business days.
• Triage — we assess severity and scope with you, and agree on a fix timeline.
• Disclosure — coordinated public disclosure is welcome after the fix is shipped, unless you prefer to remain anonymous.

For anything else about how we secure your data reach us at:

security@aetherichq.com

Aetheric HQ
548 Market St, PMB 47231
San Francisco, CA 94104, USA