Security and compliance

How Aegis protects identities, credentials, and the integrity of a compliance decision. Exact production configuration, retention periods, and hosting region are confirmed with Aurora Edge during onboarding.

Identity

Identity	How it works
Applicant	Passwordless, single-use, short-lived sign-in links. Each applicant is a distinct identity per tenant, so the same email address in two tenants shares nothing.
Staff	Email and password with multi-factor authentication available. Role or tenant changes revoke stale sessions.

Isolation

Every record is scoped to its tenant, and access is decided from the signed-in identity rather than from the request, so one tenant can never reach another's data. See Roles and access.

API credentials

Keys are stored only as hashes and compared in constant time. The secret is shown once at issue and can be rotated or revoked at any time, taking effect immediately.

Uploads

Size- and type-checked and stored encrypted. Malware scanning is available and is enabled per deployment; when it is on it is fail-closed, so an unscannable file is rejected rather than passed through.

Confirm the scanning setting for your deployment

Whether malware scanning is enabled is a per-deployment choice. Confirm it at onboarding. See Documents and AI extraction.

Screening integrity

Fail-closed throughout: an error is never a clean pass, critical hits block approval until reviewed, and dispositions must be newer than the screen they clear. See Screening.

Audit

Decisions and material changes are written to an append-only record. A full compliance report can be exported per applicant.

Data governance

Per-applicant erasure on request, retaining only the minimal required record and permanently blocking reuse of that identity.
Consent capture with timestamps.
Audit-log export.

An erased identity is why the API can return 410 for an applicant that cannot be recreated. See Onboarding API reference.

Resilience

Encryption in transit and at rest.
Scheduled backups with point-in-time recovery available.
Rate limiting on all public endpoints.
Application-integrity checks.

Backup frequency, retention, recovery objectives, and hosting region are confirmed for your deployment during onboarding rather than fixed here.