Certification-grade data, protected end to end

Tenant isolation & access control

• Row-level security on every table: all application tables run RLS; access is filtered per row.
• Workspace & project scoping: membership and role are checked in the database on every read and write.
• Least-privilege roles: owner / admin / editor / reviewer / member, evaluated server-side.
• No shared tenancy in the client: the browser only ever holds a public, anon-scoped key; privileged keys never reach it.

Encryption

• In transit: TLS 1.2+ on every connection to the application and API.
• At rest: AES-256 encryption of the database and stored objects.
• Managed key handling: encryption keys are managed by the hosting platform, not embedded in the app.
• No secrets in the browser: AI and privileged operations run behind a server-side proxy.

Authentication & account security

• Email + password with verification: accounts must confirm their address before use.
• Two-factor authentication (TOTP): optional authenticator-app second step, enforced at sign-in once enabled.
• Microsoft Entra ID (Azure AD) SSO: work-account sign-in, restricted to an approved-tenant allowlist enforced server-side.
• Idle auto–sign-out: sessions lock after 20 minutes of inactivity, every session, no exemption.
• Forced reset on recovery: a password-reset link cannot become passwordless inbox access; a new password is required.
• Password minimums & safe error handling: no account-existence disclosure on failed sign-in.

AI safety & data handling

• The engine owns every number: safety math, allocations, and robustness claims come from a deterministic core that carries its basis and citation. The AI never authors a number, a requirement, or a verdict.
• AI drafts within guardrails: the assistant is scoped to drafting and explanation; its output is reviewable and never silently written into the safety case.
• Server-side proxy: AI calls route through a controlled gateway; the client never holds a model provider key, and requests are logged for audit.
• We never train on your content — Safety Lab Aero never uses your projects, documents, or your corrections to AI drafts to train or fine-tune any model, ours or a third party’s. Real customer data stays on your own infrastructure (self-hosted, desktop, or browser-only); our hosted environment holds only trial and demo data. AI drafting is proxied to the model provider for that single request under their API terms and is not used for training, and export-controlled projects never leave your environment at all.

Data residency & export control

• US-region infrastructure: primary data stores run in a US region (US-East).
• ITAR-aware egress: an egress control governs where flagged content may be sent for processing.
• Subprocessor transparency: the full list is below and kept current.
• GCC High & on-prem: separate deployment tiers for defense programs are on the roadmap.

Data lifecycle, audit & integrity

• Self-service erasure: an account owner can permanently erase their account and all analysis data.
• Certificate of destruction: every erasure issues a signed certificate with a SHA-256 manifest of what was deleted.
• Tamper-evident sign-offs: review sign-offs are chained with a verifiable hash chain. Any signed-in member can re-verify the chain on demand, the same check runs over the AI audit log, and a scheduled job re-verifies both every day and records the result of each run.
• Audit logging: baseline cuts, review requests and review decisions are written to a workspace audit trail, and every AI call is written to a hash-chained usage log. Both records carry the actor, the action and the time; neither carries prompt or response content. Update, delete and truncate are revoked on both at the database-privilege level, so the records are append-only by privilege rather than by convention. The operator retains a break-glass path for a one-off correction, and using it writes its own record of who did what and when.

Infrastructure & subprocessors

Common questions

• Does the AI decide λ, DAL, or severity? No. Those are owned by the deterministic engine and the engineer. The AI may propose a severity with rationale for you to confirm, and may build fault‑tree structure with rates left blank, but it never establishes a safety number as fact.
• Is the AI part of the certification argument? No, by design. The AI drafts, traces, and connects; the deterministic engine and the engineer own the numbers, the allocation, and the safety case. Requirements are allocated by interpreting the fault‑tree logic, not by the AI.
• Where does my data go? The model and engine run locally in your browser or desktop app. Only an explicit AI request sends the relevant context to your configured backend: hosted proxy, your own key, or on‑premise. For ITAR projects, cloud backends are blocked server‑side (US‑sovereign cloud routing is planned).
• Can I use it on ITAR or controlled programs? Mark the relevant documents controlled; the AI is then restricted to an on‑premise backend and blocked from every cloud path, enforced server‑side (a US‑sovereign cloud option is planned). For fully air‑gapped work, the on‑premise backend keeps everything inside your boundary.
• Does it replace my DER or my engineers? No. It is a tool your engineers and DER use; the human owns every judgment and signs the safety case. The platform's job is to make the work faster and the golden thread complete and traceable.
• What standards does it follow? ARP 4754B and ARP 4761A, the means of compliance for your cert basis (AC 23.1309 / AC 25.1309 / AC 27 / AC 29 / SC‑VTOL, ASTM F3230), and DO‑178C / DO‑254 development assurance.