TRUST · PLATFORM SECURITY

How we secure
Aitamit from inside.

Here we explain what we actually do in architecture, cryptography, hardening and operations to make Aitamit genuinely secure. Only measures that exist and that you can check; what we do not have, we do not promise.

See pricing Verify a report

Security philosophy

Aitamit manages sensitive inventory and enables remote sessions on its customers' endpoints. A breach in Aitamit would not be our incident: it would be an incident for all customers at once. That is why we operate under the "secure by design, secure by default" principle: the design prevents entire categories of failure and the defaults are the secure ones.

The immutable hash-chain audit is the heart of the product: every relevant event is recorded with a SHA-256 that includes the hash of the previous event, so any retroactive alteration breaks the chain and is detectable. The reports Aitamit generates are signed with SHA-256 and can be publicly verified at https://aitamit.com/verify.

We publish this page in detail because transparency is part of security. And transparency includes stating what we do not have: no ISO certification of our own and no 24x7 SOC. Aitamit generates technical evidence (verifiable audit, signed reports, SBOM) for your organisation's certification, which is the one that matters.

SECURITY PILLARS

How Aitamit's security is built

Strict multi-tenant isolation

Every piece of data belongs to a tenant, and every query is scoped to that tenant at both application and database level. Services run in containers with resource limits on an isolated internal network: only the reverse proxy is exposed to the outside.

Encryption in transit and BYOK

TLS across the whole perimeter with HSTS, including the agent's connections to the server. For the most sensitive data, BYOK with AES-256-GCM at application level: encryption with a key provided by the customer that EDS does not hold.

Audited remote sessions

The agent works on a pull model: it is the one that opens the outbound TLS-encrypted connection, with no inbound ports exposed on the endpoints. Every remote session is recorded in the hash-chain audit: who, when, on which machine and for how long.

Immutable hash-chain audit

Every event (access, configuration change, remote session, inventory) is recorded with a SHA-256 that includes the hash of the previous event. Any retroactive modification breaks the chain and is detectable. Reports are signed and verifiable at https://aitamit.com/verify.

Infrastructure hardening

IONOS VPS in Germany (EU) managed by EDS, deployed with Docker Compose. Traefik reverse proxy with TLS + HSTS and OWASP security headers, rate limiting and brute-force protection, UFW firewall and fail2ban at the perimeter.

Supply chain

A public SBOM in SPDX format for every release, so you can audit exactly which components the platform runs. Agent binaries are published with their .sha256 checksum so you can verify their integrity before deploying them.

Operations and response

Continuity: a hot replica on a mirror VPS in the EU synchronised every 15 minutes, plus a nightly encrypted off-site backup on EDS's own infrastructure. In the event of a security incident: containment, analysis, communication to affected customers and the notifications required by the GDPR; the hash-chain audit makes it possible to demonstrate exactly what was accessed. After a tenant is terminated, its data and backups are deleted within a maximum of 90 days. And what we do not have, stated plainly: no 24x7 SOC, no bug bounty, no pentesting programme, no ISO certification of our own or "in progress". Aitamit generates the technical evidence that supports your organisation's certification.

  • TLS + HSTS: across the whole perimeter, with OWASP security headers
  • Continuity: replica every 15 min + nightly encrypted off-site backup
  • Verifiable audit: hash-chain and SHA-256-signed reports (aitamit.com/verify)
  • BYOK: AES-256-GCM at application level
  • Supply chain: public SPDX SBOM + agent .sha256 checksums
FAQ

Platform security questions

How do I verify an Aitamit report?
Every report is signed with SHA-256. At https://aitamit.com/verify you can enter the hash and check that the document is authentic and has not been altered, with no account needed.
What happens if EDS suffers an incident?
Containment and analysis, communication to affected customers and the notifications required by the GDPR. The immutable audit makes it possible to demonstrate exactly what was accessed, and the 15-minute replica plus the nightly encrypted backup allow the service to be restored.
Is BYOK available?
Yes: AES-256-GCM encryption at application level with a key provided by your organisation. EDS does not hold that key: if you revoke it, the data encrypted with it becomes inaccessible even to us.
Are you ISO 27001 certified?
No, and we are not going to tell you it is "in progress". Aitamit is built to generate the technical evidence (verifiable hash-chain audit, signed reports, public SBOM) that supports your organisation's certification, which is the one your auditors will examine.

Security questions?

If you need more detail on the platform's security measures or documentation for your due diligence, write to us at soporte@aitamit.com.

See pricing Contact us