Security, enforced —
not promised.

Canada (ca-central-1).

Same region. Multi-region available on enterprise contracts.

Runs against a US-region provider on a sanitised payload only — no personal data, no narrative text. EU-only inference configurable per-tenant if a regulator requires it.

Operator data is never used to train AI models.

Isolation is enforced at the database, not trusted to application code. Row-level security is load-bearing in production across 119 org-scoped tables — a missing org filter returns zero rows at the database edge, not the wrong operator’s data.

Every server-side endpoint filters records by the calling operator’s org. Enforced by middleware on every request.

The database itself refuses cross-tenant reads on every tenant-scoped table — even if a query forgets the org filter.

External-facing roles cannot read any tenant data. The path is closed at the database role level, not just the application.

Background workers wrap every operation in a per-org context, so even cross-tenant aggregations cannot read across operators.

A CI gate blocks any new server endpoint that lacks the org filter. Every endpoint and worker is audit-tested before deploy.

TLS 1.3 only. HSTS enforced. Modern cipher suites only.

AES-256-GCM. All databases, all backups.

Available for Tier-1 contracts.

Reporter identity is dropped at intake (null-at-write) — never stored, encrypted or otherwise. Stricter than encryption.

Every record carries an ICAO Annex-19 sensitivity tier — protected, restricted or confidential — with role allowlists and explicit, per-user clearance grants.

Sensitivity is enforced into the personal work queue, notifications, partnership data-sharing scope and the AI assistant — uniformly, not per-screen.

Without a clearance grant, the record is invisible — no row, no notification, no AI answer. Access defaults to denied.

Reporter identity is dropped at intake, so the confidential tier protects the person, not just the document.

Per-org enterprise SSO. JIT user provisioning. SAML-attribute role mapping. SP metadata endpoint.

User provisioning + de-provisioning. Bearer-token auth (hashed; token shown once on create).

Google, Microsoft and Okta. Per-org. Enforce SSO-required to disable password sign-in.

WebAuthn passkeys (Touch ID / Windows Hello / security key) — phishing-resistant. TOTP multi-factor with step-up on sensitive actions. Admin-initiated MFA reset.

Sign-in history (last 20), active-session listing and sign-out-everywhere.

Bearer-token auth with per-key scopes (records / actions / audit / webhooks), last-used tracking and audit logging by key. Available on enterprise plans.

Versioned public API with an OpenAPI 3.1 contract generated from the live runtime. Per-key scopes; every call rate-limited, tenant-isolated and audit-logged.

Standards-based connector for AI assistants — dynamic client registration (RFC 7591), mandatory PKCE (S256), single-use authorization codes, short-lived (1h) access and 30-day rotating refresh, with scoped, per-tenant consent.

A Model Context Protocol server — the protocol AI assistants use to call your tools — runs the same authorization, isolation and audit path as the UI. Bearer-authenticated and stateless.

HMAC-SHA256 signed for verification, SSRF-hardened against internal targets, with rotate-secret (shown once) controls.

Every record, workflow and admin change — action, entity, before/after, actor, IP, request id and API key id.

The audit row commits in the same database step as the change itself — not a separate, skippable insert. The log and the change succeed or fail together.

7 years minimum for safety records (ICAO Annex 13); records are retained, never auto-purged.

Searchable in-tenant by entity, actor, date and action. Export to JSON or CSV.

Append-only — no update or delete ever touches the audit log. Enforced by a CI gate.

Asynchronous export to JSON, CSV, Parquet or PDF, delivered as a 7-day signed download link.

Line-delimited JSON (NDJSON) streaming for large datasets.

Mapped CSV import (up to 50MB, processed in chunks) — no proprietary format required.

GDPR data-subject-request flow, a DPA template and a public sub-processor list.

Configurable retention for operational history (AI runs, sessions, notifications, webhooks); safety records retained.

24h notification + final-report deadlines auto-tracked. Investigation phases mapped to workflow stages.

72h preliminary + 30d final-report deadlines auto-tracked. Just-culture decision flow built-in.

SMS module aligned — hazards, safety performance indicators, risk matrix, just culture, safety culture.

FAA SMS framework. NTSB Form 6120 export.

Transport Canada SMS. TSB notification workflow.

Data-subject-request flow. DPA template available. Sub-processor list public.

ADREP / E5X / SDR export envelopes are JSON today; an XML serialization is on the roadmap.

Observation in progress (started Q2 2026).

6+ months observation post-Type I. Targeting Q4 2026.

Available on request for EU customers.

Annual independent third-party penetration test. Summary attestation available under NDA; the testing firm is identified to enterprise customers under MNDA.

Tenant data, audit log and AI execution log. Single-region, encrypted at rest.

Application + static assets served from a global edge with automatic SSL.

Calibrated AI agents for classification, risk, bow-tie and precursor detection. Operator data is never used to train models.

Durable workers for notifications, retention, scheduled reports and webhook delivery.

Transactional email for notifications, magic-links and digests.

Sessions, file uploads, and OAuth / SAML callback for enterprise identity providers.

Error tracking and observability. Stack traces only — operator records are never sent.

Subscription billing on enterprise plans (handled by an external processor; eAviora never stores card data).

Authoritative DNS, DDoS mitigation and TLS at the edge.

Full sub-processor list with vendor names and DPA links is published in our Privacy Policy 12 and Terms 09 — the legal homes for processor disclosure.