Security & Trust
AEOX is built by StarvoxLabs Pvt. Ltd. We treat the security of your brand data, credentials and connected sites as a first-order product requirement. This page is an honest account of what we do today and the standards we are building toward.
We do not yet hold ISO 27001, ISO 42001 or a VAPT certificate — our program is architected to their controls and certification is in progress. We will publish certificates here once issued.
What protects your data today
✓ Encryption everywhere
TLS/HTTPS with HSTS in transit. CMS access tokens encrypted at rest with AES‑256‑GCM. We never store CMS passwords or full card numbers.
✓ Strict tenant isolation
Every workspace is isolated at the database layer with PostgreSQL Row‑Level Security across all tables, so one customer can never read another's data.
✓ Modern authentication
Sign‑in via Supabase Auth — password (hashed, never stored by us), one‑time code, magic link, Google or Meta. Sessions are token‑based.
✓ Hardened web surface
Content‑Security‑Policy, X‑Frame‑Options, nosniff, Referrer‑ and Permissions‑Policy, and cross‑origin isolation headers on every response.
✓ Dependency & supply chain
Automated dependency scanning (GitHub Dependabot) on code and CI. Known vulnerabilities are triaged and patched — currently zero open advisories.
✓ Human‑in‑the‑loop AI
Nothing is published to your live website without your explicit approval, and every change is reversible with one‑click rollback.
✓ Access logging
Sign‑in IP and timestamps are recorded to help detect misuse, and surfaced to you in your account's Security tab.
✓ Your data, your control
Export or permanently delete your account and all its data at any time — your DPDP right to erasure, built into the product.
The standards we build to
- ISO/IEC 27001:2022 — our Information Security Management System (policies, risk register, Statement of Applicability across all 93 Annex‑A controls, incident response, access control and cryptography policies) is documented and being operated ahead of certification.
- ISO/IEC 42001:2023 — as a responsible deployer of third‑party AI (we do not train our own foundation models), we maintain an AI management system: an AI system inventory, an AI risk & impact assessment, data‑governance and a mandatory human‑oversight procedure.
- VAPT — we are scheduling an independent Vulnerability Assessment & Penetration Test by a CERT‑In‑empanelled auditor, tested against OWASP Top 10 and ASVS, with a re‑test attestation available to enterprise customers under NDA.
- India DPDP Act 2023 — we act as Data Fiduciary for account data and Data Processor for the site content you connect, with data‑principal rights, breach‑notification readiness and a published Privacy Policy.
Sub‑processors
To deliver the service we share the minimum necessary data with vetted providers — AI answer engines (OpenAI, Anthropic, Google, Perplexity, xAI, DeepSeek, Groq), infrastructure (Supabase, Render), payments (Razorpay) and a transactional email provider. The current list and the data each receives is maintained in our Privacy Policy. Enterprise customers can request our full sub‑processor register and DPA.
Report a vulnerability
We welcome responsible disclosure. If you believe you've found a security issue, email support@aeox.in. Please give us a reasonable window to remediate before public disclosure; we do not pursue legal action against good‑faith research. Our machine‑readable policy lives at /.well-known/security.txt.