How E-ARI protects your data

Your data is stored in a PostgreSQL database hosted in the European Union (Zurich, eu-central-2), encrypted at rest. Application compute runs in Frankfurt, so assessment data is processed and stored within the EU.

All traffic is served over TLS, with HTTP Strict Transport Security enforced for six months. Some sub-processors listed below operate globally; international transfers and their safeguards are described in our Privacy Policy.

Passwords are hashed with bcrypt at cost factor 12 and are never stored or logged in readable form. Sessions are signed JSON Web Tokens. Google sign-in and enterprise SSO (any OIDC provider — Okta, Entra ID, Google Workspace, Keycloak) are supported, so organisations can enforce their own MFA and offboarding.

Sign-in attempts are rate limited to eight per fifteen minutes against a given account, counted before the password is checked. The limit is keyed to the account rather than the network address, because the realistic attack is a sustained run against one known address by someone who can change addresses at will.

Every response carries HSTS, X-Frame-Options: DENY, MIME-sniffing protection, a restrictive Referrer-Policy, a Permissions-Policy disabling camera, microphone, geolocation and sensors, and a Content-Security-Policy blocking framing, base-tag injection, off-site form submission and legacy plugin embedding.

Expensive operations are rate limited per account through a database-backed counter shared across all instances. Authentication failures return a generic message; internal error details are logged server-side and never returned to the caller.

Your readiness score is not generated by a language model. It is computed by a deterministic, versioned engine — the same answers always produce the same score, and every score records the methodology version that produced it.

EU AI Act risk classification is likewise decided by rules matched against the enumerated provisions of the Regulation, not by a model. Each determination reports which provision was matched and on what wording, and is marked provisional where the Act requires a human judgement the text cannot supply. Language models write the explanatory narrative around these findings; they cannot alter a score or a risk tier, and any legal citation they produce that the rules engine did not apply is discarded before it reaches you.

Compliance-relevant actions are recorded to an append-only log. You can export your organisation’s data at any time, and request deletion, under GDPR Articles 15 and 20. Deleting your account removes your assessments and associated records.

Tests — including a live database connectivity check — run as part of every deployment. A build that fails them is not released, so a broken change stops at the pipeline rather than reaching your account.

These third parties process data on our behalf:

E-ARI is an early-stage product and we would rather you learn this here than discover it in a vendor questionnaire:

• No SOC 2 or ISO 27001 certification. We have not completed a formal audit. We do not claim compliance with either standard.
• No third-party penetration test has been conducted to date.
• No contractual uptime or incident-response SLA outside Enterprise agreements.

If your procurement process requires any of these, contact us — we would rather scope that conversation honestly than have you discover the gap late.

If you believe you have found a security issue, email security@e-ari.com with enough detail to reproduce it. We will acknowledge within three business days.

Please do not run automated scanning against production, access data that is not yours, or degrade service for other users while testing. We will not pursue legal action against researchers who report in good faith and follow that.