How we keep your data and agents safe
All traffic between your browser, API clients, and AECARO servers is encrypted using TLS 1.3. We enforce HTTP Strict Transport Security (HSTS) to prevent downgrade attacks. API endpoints require TLS 1.2 minimum, with TLS 1.3 preferred. Our TLS certificates are managed automatically through Vercel's edge network.
Data stored in our PostgreSQL database (Neon) is encrypted at rest using AES-256. Database encryption keys are managed by Neon's key management infrastructure and are separate from application access controls. File storage and backup archives are encrypted with the same standard.
LLM API keys you provide (BYOK) are encrypted at rest using AES-256-GCM with application-layer encryption before being stored in the database. Keys are decrypted only in memory at agent runtime. The encryption key is a long-lived secret held in our infrastructure's environment configuration, never exposed to the application beyond decryption at runtime. Decrypted keys are never written to logs or error traces. Only the last four characters of each key are visible in the dashboard for identification.
AECARO is built on modern, battle-tested infrastructure with security built into every layer:
Vercel Edge Network
Application hosting and serverless functions run on Vercel's global edge network. DDoS protection, WAF, and automatic TLS certificate management are included. No direct server access is needed — all deployment is infrastructure-as-code.
Neon PostgreSQL
Primary database on Neon with encryption at rest, automated daily backups, point-in-time recovery, and connection pooling. Database access is restricted to the application layer; no direct external database access is permitted. All queries go through parameterized prepared statements to prevent SQL injection.
Isolated Execution
Agent execution is sandboxed per-user, with agent-to-agent network traffic blocked at the container network layer (Docker inter-container communication disabled) so one agent can never reach another tenant's container directly. Agent containers have no network access to internal infrastructure. Execution environments are ephemeral — created per session and destroyed after completion. No agent has access to another user's data or API keys.
Clerk Authentication
User authentication is handled by Clerk, providing secure session management, multi-factor authentication (MFA/2FA), and optional SSO integration. Clerk is SOC 2 certified and processes authentication data separately from application data.
AECARO uses Clerk for authentication, supporting email/password, Google OAuth, GitHub OAuth, and enterprise SSO (SAML 2.0) on the Enterprise plan. Multi-factor authentication (TOTP) is available and recommended for all accounts.
Sessions expire after 7 days of inactivity. Users may revoke all active sessions from account settings. API sessions use short-lived tokens (1 hour) with refresh token rotation.
Team accounts distinguish an Owner from invited Members, who share access to the owner's agents, rooms, and missions. Granular per-role permissions (e.g. billing vs. agent configuration) are on our roadmap and not yet enforced — every invited member currently has the same access level. Security-sensitive actions we do audit today include agent connector grants/revocations and account deletion.
AECARO is currently undergoing SOC 2 Type II certification. We follow SOC 2 control framework principles for security, availability, and confidentiality. Expected completion: Q3 2026. During this period, we maintain internal controls aligned with SOC 2 requirements. Enterprise customers may request a SOC 2 readiness assessment report.
AECARO is fully compliant with the General Data Protection Regulation (GDPR). We process data as a data processor acting on behalf of our users (data controllers). Data processing agreements (DPAs) are available on request. Data is stored in the US (primary) and EU (on request). We support data subject access requests, deletion requests, and data portability.
A standard DPA is incorporated into our Terms of Service for all paid accounts. Signed copies are available by contacting security@aecaro.com.
We take the security of our platform seriously. If you believe you have found a security vulnerability in AECARO, we encourage you to report it responsibly.
Please email details to security@aecaro.com. Do not publicly disclose the issue before we have had an opportunity to investigate and address it.
In-scope: the AECARO web application and API (aecaro.com, including /api/v1/) and associated subdomains actually serving Aecaro traffic. Out-of-scope: Third-party services (Stripe, Clerk, Neon), physical attacks, social engineering, denial of service, and vulnerabilities in third-party LLM providers.
Aecaro is built on the same principle Open VSX applies to VS Code extensions: the platform you build on shouldn't be a black box, and your work on it shouldn't be trapped.
A worker's system prompt is not a hidden weight or a compiled binary — it's plain text you can read in full on the agent's own detail page before or after deploying it. Every connector action an agent can take is defined against a documented, versioned action spec, not an undocumented internal API.
A full account export (agents, workflows, missions, memory, and history) is available at any time from Settings — the same real mechanism GDPR Article 20 requires, available to every account, not gated to Enterprise or offered only on request.
Connector authentication can run through a self-hosted Nango instance instead of Aecaro's own managed connection — an agency or enterprise customer can run that layer on their own infrastructure rather than depend on ours for it.
The template and connector ecosystem itself is still early — a real, validated community-submission pipeline exists (automated quality and commercial-disclosure checks, a review queue) but is not yet open for public contribution. This section will be updated as that opens up, not before.
For security-related inquiries, vulnerability reports, or to request a DPA:
Email: security@aecaro.com
PGP key: Available on request
Response time: Within 48 hours for security reports