Security

Aurora Command Security One-Pager

A single scannable page covering architecture, access controls, tenant isolation, logging, encryption, incident contact, and how to request evidence. Every claim on this page is sourced from Aurora's published legal documents or repository configuration, and Aurora Command is pre-certification: no SOC 2, ISO 27001, FedRAMP, HIPAA, or PCI claim appears here.

At a glance

Architecture, Access, and Controls in One Place

Six areas buyers and auditors ask about first, each with the underlying evidence noted.

Architecture

Aurora Command is hosted on Amazon Web Services in the United States (us-west-2). Each tenant is provisioned from a dedicated Terraform stack rather than a shared, undifferentiated database.

Source: terraform/envs/tenant-infra, terraform/modules/tenant_stack

Tenant Isolation

Each tenant stack provisions its own VPC, public/private/monitoring subnets, security groups, database instance, and evidence storage bucket, tagged by tenant ID.

Source: terraform/modules/tenant_stack/main.tf

Access Controls

Role-based access control, single sign-on, SCIM provisioning, scoped service-account API keys, and IP allowlisting are available on the platform.

Source: /enterprise-controls; DPA Schedule 2 (Access management, Authentication controls)

Encryption

TLS is enforced in transit with HTTP Strict Transport Security (max-age one year, including subdomains). The production database has storage encryption enabled, and evidence storage uses a dedicated per-tenant encryption key.

Source: deploy/nginx.ssl.conf.template; terraform/modules/tenant_stack/main.tf

Logging

Authentication events, administrative actions, and security-relevant events are logged, with alerting and monitoring to identify and investigate suspicious activity. Database logs export error and slow-query events.

Source: DPA Schedule 2 (Logging and monitoring); terraform/modules/tenant_stack/main.tf

Automated Security Testing

A scanner fleet runs static analysis, secret scanning, dependency scanning, and infrastructure-as-code scanning on every pull request, with nightly dynamic application scanning against a target environment.

Source: docs/security/fleet/02-scanner-catalog.md; .github/workflows/security-*.yml

Incident contact and evidence requests

Who to Contact, and How to Request Evidence

AvailableSecurity incident contact

Report a suspected security issue to security@auroracommand.ai. Under the Data Processing Addendum, Borealis notifies affected customers without undue delay after becoming aware of a confirmed security incident involving Customer Personal Data.

Read the Vulnerability Disclosure Policy

AvailableEvidence-request path

Buyers, auditors, and insurers can request security documentation through Aurora's reviewer operations flow, or by contacting security@auroracommand.ai.

Open the Trust Center Product

PlannedIndependent penetration test

Aurora has not yet completed an independent, third-party penetration test of the platform. See the assurance roadmap for the current status.

PlannedIndependent certification

Aurora does not hold and does not claim SOC 2, ISO 27001, FedRAMP, HIPAA, or PCI certification today.

Related Trust Resources

See the subprocessor register, the data-handling matrix, or the dated assurance roadmap. For Aurora's broader security posture and reviewer access, see Aurora security & trust.

Email security

Aurora Command does not guarantee compliance outcomes or absolute security. It publishes what it can substantiate today and labels the rest planned.