Trust & Security

Security

Last updated: April 17, 2026

Overview

Your data is encrypted at rest (AES-256), isolated per tenant (Postgres Row-Level Security), and never used to train models. Every API route is gated. Every webhook is signature-verified. We keep the source of our security module out of production images.

  • Encrypted: AES-256-GCM for every piece of PII, versioned keys, rotation ready.
  • Isolated: Postgres RLS + application-layer tenant checks on every query. Zero bypass in production.
  • No training: your conversations, emails, and customer data are neverused to train a foundation model — ours or anyone else’s.
  • Verifiable: every claim below you can curl yourself from your terminal, no account needed.

Non-technical translation: we treat your business data the way your bank treats your deposits. Locked. Labeled. Yours.

Verifiable claims — test them yourself

aiOS is a product of aiOS by AI Genesis LLC. Every claim below can be verified from your terminal, right now, with zero credentials. This is the same black-box probe set our internal verifier runs on every audit.

  1. All authenticated endpoints return 401 without a token

    No exposed admin surfaces. No accidental public data routes.

    curl -sI https://api.myaios.app/ops/clients     # → 401
curl -sI https://api.myaios.app/pipeline/leads  # → 401
curl -sI https://api.myaios.app/outreach/leads  # → 401
curl -sI https://api.myaios.app/metrics         # → 401

  2. Public webhooks fail-closed on bad signatures

    HMAC verification gates every webhook. Bad signatures never reach application logic.

    curl -si -X POST https://api.myaios.app/messaging/webhooks/linq \
  -H 'content-type: application/json' \
  -H 'x-webhook-signature: deadbeef' \
  -d '{}' | head -1
# → HTTP/2 401  {"detail":"Invalid signature"}

  3. Enforced transport and browser security headers

    HSTS preload, COOP same-origin, COEP require-corp, CORP same-site, X-Frame DENY, nosniff, strict Permissions-Policy, and nonce-based CSP with no unsafe-inline for scripts.

    curl -sI https://api.myaios.app/health | grep -iE \
  'strict-transport|cross-origin|x-frame|x-content|permissions'

    Independent score: securityheaders.com · SSL Labs

  4. RFC 9116 security.txt on every production domain

    Responsible disclosure contact, PGP-ready, signed expiration.

    curl -s https://myaios.app/.well-known/security.txt
curl -s https://api.myaios.app/.well-known/security.txt
curl -s https://ai-genesis.ai/.well-known/security.txt

  5. Liveness and readiness probes are the only unauthenticated endpoints

    Kubernetes-style health signals for uptime monitors. Everything else is gated.

    curl -s https://api.myaios.app/livez   # → {"status":"alive"}
curl -s https://api.myaios.app/readyz  # → {"status":"ready"}
curl -s https://api.myaios.app/health  # → {"status":"ok",...}

Data architecture

  • Tenant isolation: PostgreSQL Row-Level Security plus application-layer tenant enforcement on every query. Zero bypass policies in production.
  • PII encryption: AES-256-GCM field-level encryption for phone, email, and other identifiers. Versioned keys with rotation support.
  • Credential vault:KEK-based envelope encryption for OAuth tokens and third-party API keys. Keys live in environment variables only — never in source.
  • Audit logging: All authenticated API calls to data endpoints, including failed auth attempts, are logged to an append-only audit table.

Access and authentication

  • Supabase JWT validation on all authenticated API routes
  • Sessions expire after 24h maximum / 2h idle
  • Role-based access control (owner > admin > member > viewer)
  • HMAC verification for all webhooks (Linq, Retell, Cal, integration providers)
  • Constant-time comparison for all secret checks
  • OAuth tokens stored encrypted at rest, never returned to the client

Infrastructure

  • API hosted on DigitalOcean App Platform with auto-scaling (2–20 instances)
  • Managed PostgreSQL with read replica and automated backups
  • Cloudflare in front of every production domain (DDoS + WAF)
  • Nonce-based Content Security Policy on both myaios.app and ai-genesis.ai
  • Containers run non-root with cap_drop: ALL and no-new-privileges
  • Security module source stripped from production images (.pyc only)
  • No production browser source maps. No debug endpoints.

Compliance posture

  • HIPAA-ready architecture: 60-day breach notification tracking, PII encryption, access audit trail, RBAC
  • GDPR / CCPA: data export, deletion, and correction endpoints. See our Privacy Policy for details.
  • SOC 2 Type II: readiness in progress. Independent attestation pending.
  • Third-party pen test: planned for 2026.

Responsible disclosure

If you believe you've found a security vulnerability in aiOS, please report it privately before public disclosure. We acknowledge reports within 24 hours.

Contact

Ask Gen