TRUST · PLATFORM SECURITY

How we secure
Aitamit from inside.

It's not enough that frameworks say you comply. Here we explain what we do in architecture, cryptography, operation, hardening, supply chain and incident response to make Aitamit genuinely secure. No marketing, with concrete verifiable details.

See pricing Request pentesting report

Security philosophy

Aitamit manages sensitive inventory and enables remote control over critical organization endpoints: hospitals, PAs, banks, fintechs, accountancy firms. A breach in Aitamit is not our incident; it's an incident for all customers simultaneously. That's why we operate under "secure by design, secure by default, secure by operation": design prevents entire failure categories, defaults are secure, operation continuously audited.

The immutable hash-chain audit Aitamit offers customers we also apply to our own internal operation: each EDS technician's production access logged with verifiable SHA-256. Each tenant config change with cryptographic timestamp. Zero exceptions for administrators. If EDS were hacked tomorrow, logs would be demonstrably unalterable.

We deliberately publish this page verbose because we believe transparency is part of security. If we only say "we take security seriously" without details, you can't verify anything. So we explain architecture, crypto decisions, operation, cluster hardening, supply chain, pentesting program and incident response process with concrete data.

SECURITY PILLARS

How Aitamit's security is built

Strict multi-tenant isolation

Each tenant has separate logical database with tenant_id in all tables and RLS (Row Level Security) in PostgreSQL. Kubernetes cluster with NetworkPolicies segmenting traffic per namespace. For Enterprise: single-tenant option with dedicated Kubernetes cluster and BYOK.

At-rest and in-transit encryption

TLS 1.3 mandatory on all communications (agent-server, client-server, server-DB). AES-256-GCM at-rest encryption for PostgreSQL and MinIO/S3. For highly sensitive data (audit logs): application-level encryption with per-tenant key. Optional BYOK Enterprise.

E2E remote sessions

Ephemeral Diffie-Hellman for each remote control session. Not even EDS can read screen, audio, keyboard content during a session. Only metadata (who accessed, when, duration) in logs. Optional recording with signed SHA-256 stored in customer MinIO/S3.

Immutable hash-chain audit

Each event (access, config change, remote session, inventory, executed command) logged with SHA-256 including previous log hash. Any retroactive modification breaks chain and is detectable. Unalterable even by EDS DBAs.

Kubernetes cluster hardening

CIS Kubernetes Benchmark v1.8 fully applied. Pod Security Standards "restricted". NetworkPolicies per namespace. Service Mesh (Istio) with automatic mTLS. Secrets encrypted with sealed-secrets + external-secrets from HashiCorp Vault. Ingress with WAF (ModSecurity + OWASP CRS).

Supply chain security

SBOM published for each release (SPDX + CycloneDX format). Docker images signed with cosign + sigstore. SLSA Level 3 provenance attestations. Renovate bot for vulnerable dependency detection. CI/CD rejects merge if critical CVEs unpatched.

Operation and response

Annual pentesting program with BDO Madrid: three weeks of testing, detailed report, mandatory pre-publication remediation. Public bug bounty from Q3 2026. Internal SOC with 24x7 detection (Wazuh + Grafana + alerts to rotating duty team). RTO <4h, RPO <15 min for Enterprise. Encrypted off-site backups with MinIO replication to three different EU datacenters. Incident response process: automatic detection + severity analysis + escalation to EDS CISO + communication to affected customers in <2h for confirmed incidents + public post-mortem 7 days later with root cause and preventive measures. Transparent policy: we communicate incidents even when legally not required.

  • Annual pentesting: BDO Madrid (independent firm)
  • Internal SOC 24x7: permanent rotating duty
  • RTO <4h, RPO <15 min: for Enterprise customers
  • Encrypted backups: replicated to 3 EU datacenters
  • Transparent policy: incident communication in <2h
FAQ

Platform security questions

Can I request the latest pentesting report?
Yes, for Enterprise customers under NDA. For prospects: under NDA after Stage 2 of sales process. Report includes scope, methodology, findings classified by CVSS severity, evidence and remediation plan with closing dates.
What if EDS is hacked?
Typical detection <30 min via internal SOC. Analysis and containment <4h. Communication to affected customers <2h after confirmation. Immutable audit logs allow demonstrating exactly what was accessed. Off-site backups allow restoring to pre-incident point. Public post-mortem 7 days later.
Is BYOK available?
Yes, for Enterprise tier. BYOK with AWS KMS, Azure Key Vault, GCP KMS or your organization's HashiCorp Vault. EDS has no access to your data encryption keys. If you revoke keys, data becomes inaccessible even to us.
Are you ISO 27001 compliant?
We have controls implemented per ISO 27001:2022 Annex A. Formal certification in process (Q3 2026, AENOR certifier). For customers needing formal evidence while it arrives: BDO Letter of Engagement as independent auditor available under NDA.

More details under NDA

If you need full pentesting report, detailed technical architecture or security due diligence: contact us.

See pricing Request report