Security
How we protect your data
Security is not a checklist at Aureus — it is a core constraint of how the infrastructure is designed. This page documents our practices across encryption, access control, backups, and operations.
Compliance
ISO/IEC 27001 — Information Security Management
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It defines a risk-based framework for protecting the confidentiality, integrity, and availability of information — covering policy, access control, cryptography, supplier management, incident response, and continuous improvement, with formal independent audits.
Aureus is certified to ISO/IEC 27001:2022 by BSI (British Standards Institution), one of the world's most established certification bodies. Our Information Security Management System covers the practices documented on this page — dedicated infrastructure, AES-256 encryption, least-privilege access, audit logging, weekly backup verification, and 24/7 monitoring — and is independently audited against the Annex A control families defined by the standard.
To request a copy of our BSI certificate, Statement of Applicability, or most recent audit report under NDA, contact [email protected].
Infrastructure isolation
Dedicated hardware per cluster
Every Aureus cluster runs on dedicated physical infrastructure. Your database does not share CPU, memory, or storage I/O with any other customer. There is no multi-tenant hypervisor layer — the physical machine is allocated exclusively to your workload.
Network segmentation
Cluster networks are isolated at the hardware level. Database ports are not publicly exposed by default. Access is restricted to allowlisted IP ranges you control, with all connections tunneled over encrypted channels.
No shared kernel risk
Single-tenant dedicated hardware eliminates the side-channel attack surface (Spectre, Meltdown variants) that exists in multi-tenant cloud environments where co-located workloads share physical CPU caches.
Encryption
Encryption at rest — AES-256
All data volumes, including primary data directories, WAL segments, and backup archives, are encrypted at rest using AES-256. Encryption keys are managed separately from the data they protect and rotated on a defined schedule.
Encryption in transit — TLS 1.3
All connections to Aureus clusters require TLS 1.3. Plaintext connections are rejected at the network layer. This applies to application connections, replication streams, and all administrative access.
Backup archive encryption
Offsite backup archives are encrypted before transmission and stored encrypted at the destination. Encryption keys for backup archives are stored in a separate, access-controlled system — not alongside the archives themselves.
Backup & recovery
Continuous WAL archiving
Write-ahead log segments are continuously archived to offsite object storage, enabling point-in-time recovery to any moment within the retention window. Recovery point objective (RPO) is typically under 5 minutes.
Daily base backups with 30-day retention
Full base backups are taken daily and retained for 30 days. Archives are stored in a geographically separate region from the primary cluster.
Weekly automated restoration tests
Backups are automatically restored and verified weekly against a non-production environment. Schema integrity and row counts are validated. Customers can view their current restoration time (RTO) in the dashboard.
Immutable backup storage
Backup archives are written with object lock enabled. Archives cannot be deleted or modified by application-layer processes — only by authorized operations with explicit expiry after the retention period.
Access control
Least-privilege database roles
Application credentials are provisioned with minimal required privileges. Superuser access is not provided to application users. Administrative access is separated and restricted to named staff with individual credentials.
IP allowlisting
Database access can be restricted to specific IP ranges or CIDR blocks. By default, clusters reject connections from any IP not on the allowlist.
Multi-factor authentication for dashboard access
All dashboard accounts support TOTP-based two-factor authentication. Staff accounts with administrative access require MFA. Session tokens are short-lived and invalidated on password change.
API key scopes
Programmatic access via the Aureus API uses scoped API keys. Each key is granted only the permissions explicitly needed — read-only keys cannot modify resources. Keys can be revoked instantly from the dashboard.
Operational security
Patch management
Security patches for the operating system and PostgreSQL are applied on a defined schedule. Critical CVEs are patched within 48 hours. Major version upgrades are coordinated with customers in advance.
Audit logging
All administrative actions on customer clusters — connections, configuration changes, backup operations — are logged with timestamp, actor, and action. Logs are retained for 90 days and available on request.
Monitoring and alerting
All clusters are monitored 24/7 for availability, performance anomalies, and security events. Alerts are routed to the on-call team with defined escalation paths and response time targets.
Vendor access controls
Aureus staff access to customer data is restricted to what is necessary to resolve a specific support issue. Access is logged. Customers can request an access log for their cluster at any time.
Responsible disclosure
Report a vulnerability
If you discover a security vulnerability in Aureus infrastructure or the customer dashboard, please report it to [email protected]. We ask that you give us a reasonable time to investigate and respond before public disclosure.
What to include
Please include a description of the vulnerability, steps to reproduce, potential impact, and any proof-of-concept. We will acknowledge receipt within 24 hours and provide a resolution timeline within 72 hours.
Scope
In-scope: aureus.cx and all subdomains, the customer dashboard, and the public API. Out of scope: denial of service attacks, social engineering, and physical security.
Security questions or concerns?
For general security questions, reach out to your account manager or open a support ticket. To report a vulnerability, email us directly.