Security & Compliance

How we protect your data and comply with regulations. Last updated: June 2026.

Infrastructure

  • Hosted in Frankfurt, Germany (Hetzner) — data stays in the EU
  • PostgreSQL 16 with automated backups
  • Redis 7 for session management and rate limiting
  • Nginx reverse proxy with TLS 1.3 termination

Encryption

  • HTTPS everywhere — all traffic encrypted in transit (Let's Encrypt)
  • API keys hashed with bcrypt — never stored in plaintext
  • BYOK keys encrypted with AES-256-GCM — at rest, application-level encryption
  • Passwords never stored — OAuth2-based authentication only

Access Control

  • RBAC — three roles (admin, senior, junior) with granular permissions
  • API keys per tenant with individual revocation
  • Multi-tenant isolation — each tenant sees only their own data
  • Rate limiting per tenant and per IP to prevent abuse

Audit & Monitoring

  • Immutable audit logs — every action recorded, cannot be modified or deleted
  • HMAC-SHA256 signatures — verify log integrity at any time
  • CSV export for external audits (SOC2/HIPAA)
  • Admin-controlled audit log access — delegate to specific roles

Data Privacy (GDPR)

  • All user data stored and processed in Germany (EU)
  • Right to deletion — email support@aievaluator.dev to delete your account and all data
  • Data Processing Agreement (DPA) available on request
  • Cookie consent via CookieScript — no tracking without consent
  • No third-party data sharing — your data is yours
  • Minimal data collection — only what's needed to provide the service

Authentication

  • OAuth2 via Google, GitHub, GitLab, and Bitbucket
  • Enterprise SSO with SAML 2.0 (Okta, Azure AD, OneLogin, Ping)
  • OIDC support for Google Workspace and Azure AD / Entra ID
  • Automatic session expiry

Application Security

  • Input validation on all API endpoints
  • SQL injection prevention via parameterized queries
  • No secrets in code — all sensitive values via environment variables
  • Dependencies regularly audited

Need a DPA or security questionnaire?

We can provide a Data Processing Agreement, complete your vendor assessment form, or answer any security questions from your procurement team.

Contact us: support@aievaluator.dev