Security & data
How AIM protects your data and proves every decision.
What we do today, stated plainly. Have a security questionnaire? Email signal@veraxius.com.
Isolation by organization
- Every API request is authenticated with your organization's API key, and each organization only ever sees its own data. Requests for another organization's records return "not found."
- Each pilot receives its own base URL and API key when it starts.
Credentials
- API keys are shown once when issued. We store only their hash.
- Human approvals require a separate operator sign-in. Operators receive a 12-hour token and can only act for their own organization.
Integrity and audit
- Every event in a decision's life is written to a hash-chained governance log: each event stores the hash of the previous one, and you can verify the chain for any decision through the API.
- Evidence submitted to AIM is stored with a SHA-256 hash of its content.
- Policies are versioned and immutable, so you can always prove which rule applied.
Safe execution
- An authority can be used once. Validation and consumption are atomic, even under concurrent requests.
- Actions must fit the authorized envelope, for example a maximum refund amount.
- Idempotency keys make retries safe: nothing executes twice.
- An AI can never approve its own request, and unanswered reviews are held, not granted.
Data handling
- We process pilot data on your organization's behalf and under your instructions.
- Send only what AIM needs: agent identifiers, proposed actions, outcomes and evidence. Please don't send sensitive personal data.
- AIM scores may not be used to decide eligibility for employment, credit, housing, insurance or government benefits.
- We do not sell personal information.
- Website privacy policy · App privacy policy
Transport and availability
- All traffic uses HTTPS.
- Rate limits protect the service, and responses include standard RateLimit headers.
Report a vulnerability
If you find a security issue, email signal@veraxius.com. We'll acknowledge your report and keep you updated.