Security posture
Built for calm, governed by controls.
Security is a design constraint, not an afterthought. Here is how we protect client data and operate the service.
Identity & access
- • MFA (multi-factor authentication) enforced on production systems and cloud providers.
- • Least-privilege roles; time-bound access for elevated tasks.
- • SSO (single sign-on) preferred for client environments where supported.
Data protection
- • TLS (encryption in transit) and reputable cloud storage with encryption at rest.
- • Segregated workspaces per client; no mixing of client datasets.
- • Backups with tested restores for critical repositories and configurations.
Secure engineering
- • Source control with mandatory reviews for production changes.
- • Secrets vaulted; no credentials in source code or chat.
- • Dependency scanning and pinned versions for critical libraries.
Operations
- • Device management with disk encryption and screen lock policies.
- • Logging for admin actions on core systems; alerts for suspicious access.
- • Change records for client environments with approvals before production impact.
Vendor diligence
- • Vendors are selected for security posture (SOC 2/ISO where applicable) and data minimization, not just features.
- • Standard Contractual Clauses or equivalent protections for international transfers.
- • Regular access reviews for vendor integrations and tokens.
Incident response
- • Playbooks for triage, containment, and recovery; severity-based timelines.
- • Client notification commitments for confirmed incidents impacting their data.
- • Post-incident reviews with corrective actions tracked to completion.
Data handling with clients
- • Clear scope of systems and data before access is granted.
- • Separate admin and user accounts; no shared credentials.
- • Export/return and destruction of data at engagement end, per contract.
Your role
- • Designate an owner for access approvals and incident communications.
- • Provide timely information on system changes that could affect risk.
- • Enforce MFA and least privilege within your own tools; we will recommend specific settings.
Questions or requests
For security reviews, questionnaires, or to request a copy of incident and continuity playbooks, email info@theauraarchitect.co. We respond promptly and with specific answers, not marketing fluff.