How E-ARI protects your data

Application compute is pinned to Frankfurt (fra1) for application functions. Your data is stored in a PostgreSQL database hosted on Supabase (AWS eu-central-2, Zurich), encrypted at rest. Switzerland is not an EU member state; the European Commission recognises it as providing an adequate level of data protection. Neither location means that model processing or every sub-processor runs in Europe: the default model provider processes data in China, and the register below gives each provider’s region. We do not claim EU-only data residency.

All traffic is served over TLS, with HTTP Strict Transport Security enforced for six months. Some sub-processors listed below operate globally; international transfers and their safeguards are described in our Privacy Policy.

Passwords are hashed with bcrypt at cost factor 12 and are never stored or logged in readable form. Sessions are encrypted JSON Web Tokens (JWE, A256GCM) in an HTTP-only cookie, expiring after 24 hours of inactivity — the encryption is NextAuth’s implementation, not ours. Google sign-in is supported. Enterprise SSO (OIDC) is configured by the E-ARI platform operator. Enforcement rejects password sign-in while the configured OIDC provider is registered; the password path is available when it is not registered. This is not per-workspace customer-managed SSO or SCIM provisioning. IP allowlisting, custom session policies and additional controls must be agreed and verified separately; they are not implied by the Enterprise plan.

Sign-in attempts are rate limited to eight per fifteen minutes against a given account, counted before the password is checked. The limit is keyed to the account rather than the network address, because the realistic attack is a sustained run against one known address by someone who can change addresses at will.

Page and portal responses carry HSTS, X-Frame-Options: DENY, MIME-sniffing protection, a restrictive Referrer-Policy, a Permissions-Policy disabling camera, microphone, geolocation and sensors, and a Content-Security-Policy blocking framing, base-tag injection, off-site form submission and legacy plugin embedding. The auth, webhook and cron endpoints are deliberately excluded from that middleware, as are static assets.

Expensive operations are rate limited per account through a database-backed counter shared across all instances. Two limits worth stating plainly: if the database is unreachable the check falls back to a per-instance in-memory window rather than failing closed, and an operator can disable rate limiting platform-wide from the admin console. Authentication failures return a generic message; internal error details are logged server-side and never returned to the caller.

Your readiness score is not generated by a language model. It is computed by a deterministic, versioned engine — the same answers always produce the same score, and every score records the methodology version that produced it.

EU AI Act risk classification is likewise decided by rules matched against the enumerated provisions of the Regulation, not by a model. Each determination reports which provision was matched and on what wording, and is marked provisional where the Act requires a human judgement the text cannot supply. Language models write the explanatory narrative around these findings; they cannot alter a score or a risk tier, and any legal citation they produce that the rules engine did not apply is discarded before it reaches you.

Operator actions — tier and role changes, account deletion, unlocks, settings changes, refunds — are written to an admin audit log with the actor, the target and a timestamp. That log covers what we do to an account; it is not a full record of everything you do inside the product. You can export your organisation’s data at any time from Account & billing, as a single JSON file covering your assessments and answers, registered AI systems, classifications, evidence metadata, obligation gaps and training records. Deletion is by request to support rather than a button: mail support@e-ari.com and we remove the account, its records and the files themselves.

The release build runs automated checks. Passing checks does not establish that every production dependency or client workflow has been independently verified.