How we keep your data and agents safe
All traffic between your browser, API clients, and AECARO servers is encrypted using TLS 1.3. We enforce HTTP Strict Transport Security (HSTS) to prevent downgrade attacks. API endpoints require TLS 1.2 minimum, with TLS 1.3 preferred. Our TLS certificates are managed automatically through Vercel's edge network.
Data stored in our PostgreSQL database (Neon) is encrypted at rest using AES-256. Database encryption keys are managed by Neon's key management infrastructure and are separate from application access controls. File storage and backup archives are encrypted with the same standard.
LLM API keys you provide (BYOK) are encrypted at rest using AES-256-GCM with application-layer encryption before being stored in the database. Keys are decrypted only in memory at agent runtime. Our encryption key is rotated every 90 days. Decrypted keys are never written to logs or error traces. Only the last four characters of each key are visible in the dashboard for identification.
AECARO is built on modern, battle-tested infrastructure with security built into every layer:
⚡Vercel Edge Network
Application hosting and serverless functions run on Vercel's global edge network. DDoS protection, WAF, and automatic TLS certificate management are included. No direct server access is needed — all deployment is infrastructure-as-code.
🗄️Neon PostgreSQL
Primary database on Neon with encryption at rest, automated daily backups, point-in-time recovery, and connection pooling. Database access is restricted to the application layer; no direct external database access is permitted. All queries go through parameterized prepared statements to prevent SQL injection.
🔒Isolated Execution
Agent execution is sandboxed per-user. Agent containers have no network access to internal infrastructure. Execution environments are ephemeral — created per session and destroyed after completion. No agent has access to another user's data or API keys.
🔑Clerk Authentication
User authentication is handled by Clerk, providing secure session management, multi-factor authentication (MFA/2FA), and optional SSO integration. Clerk is SOC 2 certified and processes authentication data separately from application data.
AECARO uses Clerk for authentication, supporting email/password, Google OAuth, GitHub OAuth, and enterprise SSO (SAML 2.0 / OpenID Connect on Team and Enterprise plans). Multi-factor authentication (TOTP) is available and recommended for all accounts.
Sessions expire after 7 days of inactivity. Users may revoke all active sessions from account settings. API sessions use short-lived tokens (1 hour) with refresh token rotation.
Agency accounts support role-based access: Owner, Admin, and Member roles with granular permissions for client management, billing, and agent configuration. Audit logs track all role changes and sensitive actions.
AECARO is currently undergoing SOC 2 Type II certification. We follow SOC 2 control framework principles for security, availability, and confidentiality. Expected completion: Q3 2026. During this period, we maintain internal controls aligned with SOC 2 requirements. Enterprise customers may request a SOC 2 readiness assessment report.
AECARO is fully compliant with the General Data Protection Regulation (GDPR). We process data as a data processor acting on behalf of our users (data controllers). Data processing agreements (DPAs) are available on request. Data is stored in the US (primary) and EU (on request). We support data subject access requests, deletion requests, and data portability.
A standard DPA is incorporated into our Terms of Service for all paid accounts. Signed copies are available by contacting security@aecaro.com.
We take the security of our platform seriously. If you believe you have found a security vulnerability in AECARO, we encourage you to report it responsibly.
Please email details to security@aecaro.com. Do not publicly disclose the issue before we have had an opportunity to investigate and address it.
In-scope: AECARO web application (app.aecaro.com), API endpoints (api.aecaro.com), and associated subdomains. Out-of-scope: Third-party services (Stripe, Clerk, Neon), physical attacks, social engineering, denial of service, and vulnerabilities in third-party LLM providers.
For security-related inquiries, vulnerability reports, or to request a DPA:
Email: security@aecaro.com
PGP key: Available on request
Response time: Within 48 hours for security reports