Trust centre

System status

Every part of Aither, from sign-in and tickets to email, AI and billing, is checked from our servers every few minutes. The status page shows each one live, with uptime for the last 90 days.

Security controls

Data protection

• HTTPS for every connection, including between the app and its database, where the database's certificate is verified.
• Encrypted disks and backups for the database, plus AES-256-GCM encryption inside the app for conversation text, internal notes, sent messages and connected-app keys. A copy of the database can't be read without a key kept outside it.
• Passwords, sign-in sessions and one-time links are stored only as hashes.
• Customer data logically separated per workspace; encrypted values are bound to their workspace and won't decrypt anywhere else.
• Owners can delete their workspace at any time. Everything in it is removed straight away, and database backups age out within 7 days.

Access

• Two-step sign-in with any authenticator app, which owners can require for the whole team, and sign-in with Google.
• Four roles: owners and admins change settings, keys, billing and limits; agents work the inbox; viewers can look but not change anything.
• A fresh password check before anything sensitive: connecting keys, billing, team changes, money limits.
• Only Aither’s founder can reach production systems and customer data, and only to run and support the Service.

Operations

• The deployment is defined in code and released automatically from version control, with a health check before each new version takes traffic.
• Encrypted daily backups with 7 days of point-in-time restore, kept in Canada.
• If a breach affects your data, we tell you promptly, with what happened and what we’re doing about it, as Canadian privacy law requires.

AI safeguards

Aither takes real actions for your business, so its limits are part of the product rather than an afterthought.

• Guardrails you write in plain words. Every rule is compiled into an allow, ask or block decision you can read.
• Hard limits on actions. Each action type has its own permission and ceiling, such as refunds over $200 needing approval.
• Confidence thresholds. Below the level you set, Aither drafts and hands off instead of replying.
• Prompt-injection defences. Customer messages are treated as untrusted input and can’t change policies or permissions.
• A full audit log. Every reply and action is recorded with the sources and rule it relied on.
• Clear disclosure. Customers are always told they are talking to an AI.

Data and privacy

For your customers’ data, Aither is your processor: we use it only to provide the Service, as set out in our terms. A data processing agreement is being prepared; email [email protected] if you need one. Read the privacy notice for how we handle information about you.

Compliance

Subprocessors

These companies process customer data on our behalf. We email account owners at least 30 days before adding a new one.

Documents on request

Security reviews go faster with the paperwork in hand. Ask and we’ll help with what you need.

• Data processing agreementIn preparation. Tell us you need oneRequest
• Your security questionnaireSend it over and we’ll complete itSend it

Report a vulnerability

If you think you’ve found a security problem, email [email protected] with the steps to reproduce it. We’ll acknowledge it within two working days and keep you updated until it’s fixed.

We won’t take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and that gives us reasonable time to fix the issue before disclosure.