Security overview.

1. 01

   Tenant isolation by design.

   Customer content lives in logically isolated tenants; isolation is enforced on every read and write, so no cross-tenant access is possible through the application.

2. 02

   Least privilege everywhere.

   Production access is restricted to a small group of named engineers, gated behind hardware-key multi-factor authentication, and granted just-in-time through audited tooling.

3. 03

   Auditable by default.

   Configuration changes, access-control decisions, and administrative actions are recorded to an append-only audit log. Tenant administrators can export their organization’s audit log on demand.

4. 04

   Reproducibility as a security property.

   Every reading produced by the workbench can be re-derived from the source set it was built on. Tampering or undetected drift is observable.

Data in transit between users, the Service, and sub-processors is encrypted using TLS 1.2 or higher with modern cipher suites. We enforce HSTS on aculeus.ai and the workbench and reject insecure connections.

Data at rest in our primary data stores and object storage is encrypted using AES-256 with keys managed in a hardened key-management service. Backups inherit the same encryption and are rotated on a fixed schedule.

Customer-managed encryption keys (CMEK) are on the roadmap and available on request for enterprise tenants under early access.

Aculeus runs on hardened public-cloud infrastructure across multiple availability zones.

Production environments are logically segregated from non-production environments and from corporate systems. Network access between services is restricted by service-account identity and least-privilege IAM policy.

Operating-system images are hardened, patched on a regular cadence, and rebuilt from base images rather than mutated in place. Production hosts run only the services they are designated for; administrative shell access is rare and audited.

Configuration drift is detected by continuous control monitoring. Infrastructure changes go through code review and CI pipelines and are recorded in an immutable change log.

Every change moves through a secure-software-development lifecycle before it ships.

1. 01Threat modeling
2. 02Static analysis
3. 03Dependency scanning
4. 04Security code review
5. 05Security-path tests

Threat modeling at design time, static analysis on every commit, dependency vulnerability scanning, security-focused code review, and automated tests over security-relevant paths. Secrets are managed exclusively through a dedicated secret store; secrets are never committed to source control.

Independent penetration testing of the workbench and supporting infrastructure is part of our security program. As assessments are completed, reports are made available to customers under NDA and findings are tracked to remediation on a severity basis.

We run a coordinated disclosure program for external researchers (see “Vulnerability reporting” below).

Each Aculeus customer is provisioned into a logical tenant, and every workbench request is checked against it at three layers before it can touch data.

1. 01Application layer
2. 02Data layer
3. 03Storage layer

A tenant identifier is verified at each of these layers; cross-tenant queries are not constructible through the public API. For customers requiring stronger isolation (regulated industries, sovereign-data requirements), Aculeus offers single-tenant deployments under negotiated terms.

Production data stores are backed up continuously to encrypted, geographically separated storage. Backups are tested for restorability periodically. Our standard recovery objectives are a recovery point objective (RPO) of one (1) hour and a recovery time objective (RTO) of four (4) hours for the workbench application; specific commitments to your tenant may be set out in your order form.

Application, infrastructure, and access logs are centralized in an immutable, write-only store and retained for at least thirteen (13) months. Logs are monitored continuously and tied into our incident-response pipeline.

Tenant administrators can export the audit log for their organization on demand. Programmatic delivery into a customer SIEM (streaming webhook or scheduled export) is on the roadmap for enterprise plans.

Aculeus maintains a written incident-response plan with named roles, escalation paths, communication templates, and post-incident review requirements. The plan is reviewed and exercised periodically.

Post-incident, we publish a written review to affected customers describing root cause, scope, and remediation.

Aculeus uses third-party sub-processors for cloud infrastructure, email delivery, monitoring, and customer support tooling, and the AI and research providers that process content to produce readings. Each sub-processor is engaged under a written contract that imposes confidentiality, security, and processing restrictions consistent with applicable data-protection law and the Aculeus DPA.

The current named sub-processor list, the function each performs, and the regions in which each operates are published and kept current. Customers on enterprise plans are notified at least thirty (30) days before a new sub-processor is added and may object as set out in the DPA.

Aculeus personnel are subject to background checks where permitted by law, complete privacy and security training, and sign confidentiality obligations as a condition of employment.

Production access is the most tightly held privilege at Aculeus.

Granted

Just-in-time

Authenticated

Hardware-key MFA

Recorded

Fully audited

Revoked

On role change

Access to production systems and customer content is restricted to a small group of named engineers with documented business need: granted just-in-time, requiring hardware-key MFA, fully audited, and revoked promptly on role change or departure.

We welcome reports of suspected vulnerabilities. Where possible, encrypt sensitive details using our PGP key (published on request).

We commit to acknowledging good-faith reports within one (1) business day and triaging within five (5) business days. We do not pursue legal action against researchers who follow coordinated disclosure, avoid privacy violations and service disruption, and refrain from publishing details until we have had a reasonable opportunity to remediate.

This overview describes Aculeus's current security posture. It is informational and does not modify any contractual commitment in an order form or data processing addendum, which take precedence in the event of conflict.