Security
Built for the systems your business can’t afford to break.
Aedeon reads and changes the software your business runs on. So we made security the architecture, not a checklist: private by default, isolated by design, encrypted end to end, and nothing ships without your team’s sign-off.
What your security team will ask
Six questions, answered before you have to ask them.
Every security review of an AI platform comes down to the same six questions. Here are our answers, in plain language.
Where does our code run?
In a private VPC, with no shared runtime and no public-facing application surface. On Max you can deploy in your cloud or multi-cloud. Virtual Private Aedeon runs single-tenant in your sovereign region, and air-gapped deployment is supported.
Who can see our graph?
Only you. Your graph and every analysis derived from it run tenant-isolated: no pooled indexes, no cross-tenant embeddings, no shared model context.
Is our code used to train AI?
No, on any plan, including the free trial. That includes our own planning model, Aedeon Supervisor, which is trained on engineering best practices only.
Which AI models touch it?
Frontier models from Anthropic, OpenAI, Google Gemini and xAI Grok, limited to the ones your organization approves. On Virtual Private Aedeon, you control the model routing.
Can an agent change production on its own?
No. Agents act only inside approved plans, with human sign-off at every gate. Every change is verified against the old system on your real traffic before it ships.
Who holds the keys, and what do we keep?
Data is encrypted in transit, at rest and in archival. Customer-controlled keys are optional on Max and required on Virtual Private Aedeon. Your graph is exportable, and every change lands in your own Git.
Deployment architecture
The perimeter, and everything inside it.
Private by default
Every Aedeon deployment runs in a private VPC: no shared runtime and no public-facing application surface. Virtual Private Aedeon goes further, fully single-tenant in your sovereign region, with customer-controlled keys and fully exportable data.
Defended at the perimeter, and inside it
Application firewalls front every service. Real-time threat monitoring and IDS/IPS protection run continuously across the deployment, and anomalies alert your security team through the channels it already uses.
Encrypted end to end
Your data is encrypted in transport, at rest and in archival: from the moment your code is read, through graph storage, to long-term retention.
Product guarantees
Isolation, ownership and human control, by design.
These are properties of how Aedeon is built, not settings someone can switch off.
Tenant isolation, by architecture
Your graph and every analysis derived from it run tenant-isolated. No pooled indexes, no cross-tenant embeddings, no shared model context.
Your code stays yours
No training on customer code, including our own planning model. Your graph is exportable, and it belongs to you.
Your people hold the keys
Agents act only inside approved plans, with human sign-off at every gate. Every change lands with its complete history attached: an audit trail that exists by construction, not by policy.
Compliance moves with every change
Every change carries an impact analysis, including its compliance impact in regulated workflows. On Max, full audit logs include SOX, PCI and HIPAA impact diffs.
Provenance
Every change arrives with its evidence attached.
Every commit ships with the graph nodes it came from, the citation-validated analysis that justified it, the model that generated it, the person who approved each gate, and the verification runs that passed. When your auditor asks why something changed, the answer is already in your Git.
- graph nodes
- invoice, rate_tier, sp_calc_rate_tier
- citations
- sp_calc_rate_tier.sql : L212–L268
- model
- Anthropic · via Aedeon Supervisor
- approvals
- arch-review · gate-2
- prove runs
- 3/3 passed · behavior / data / app
Security by plan
Choose the control your regulators expect.
Every plan gets the same core protections: a private VPC, encryption end to end, tenant isolation and no training on your code. What changes by plan is who controls the keys, the region and the models.
| Pro | Team | Max | Virtual Private Aedeon | |
|---|---|---|---|---|
| Encryption keys | Aedeon-managed | · | Customer-controlled, optional | Customer-controlled, required |
| Single sign-on | · | Optional SSO / SAML | Standard SSO | · |
| Audit logs | · | Standard audit logs | Full audit logs + SOX / PCI / HIPAA impact diffs | · |
| Where it runs | · | · | Your cloud or multi-cloud | Dedicated single-tenant instance, customer-sovereign region (US, EU, APAC, country) |
| Air-gapped deployment | · | · | · | Supported |
| Foundation-model routing | · | · | · | Customer-controlled |
| Support | Business hours | Dedicated success + 24/7 SLA | · |
Taken from the plan details on our pricing page. A dot means the plan’s published details don’t list it; ask us for the full entitlement sheet.
Industry benchmark
Measured against the OWASP Top 10 for LLM Applications.
OWASP’s 2025 list is the reference most security teams use to assess AI systems. Here is where Aedeon’s published architecture answers each risk, and where we’d rather walk your team through the detail in person.
| Risk | How Aedeon’s design answers it | Status |
|---|---|---|
| LLM01Prompt injection | Agents act only inside plans a person has approved, which limits what any injected instruction could do. Our specific input defenses are covered in the security briefing. | Ask us |
| LLM02Sensitive information disclosure | Tenant isolation by architecture: no pooled indexes, no cross-tenant embeddings, no shared model context. No training on customer code. | By design |
| LLM03Supply chain | Models are limited to the providers your organization approves. On Virtual Private Aedeon, you control the model routing yourself. | By design |
| LLM04Data and model poisoning | Your code never trains any model, including Aedeon Supervisor. How Supervisor’s own training data is curated is covered in the security briefing. | Ask us |
| LLM05Improper output handling | No AI output reaches production directly. Every change is verified against the old system on your real traffic, and a person approves every gate. | By design |
| LLM06Excessive agency | Agents act only inside approved plans, with human sign-off at every gate. Your architects can edit any plan before it runs. | By design |
| LLM07System prompt leakage | Not described in our public documentation. Covered in the security briefing. | Ask us |
| LLM08Vector and embedding weaknesses | No pooled indexes and no cross-tenant embeddings. Your graph and its analysis stay inside your tenant. | By design |
| LLM09Misinformation | Citation-validated analysis: every claim an agent makes must cite specific files, lines and schema objects. A claim that can’t cite the code is rejected. | By design |
| LLM10Unbounded consumption | Every change plan shows its estimated cost before anyone approves it, and nothing runs until a person does. | By design |
This mapping is Aedeon’s own reading of our published architecture against the OWASP Top 10 for LLM Applications (2025). It is not a third-party assessment or certification.
Certifications
Audits underway, and open about it.
We’d rather tell you exactly where we are than put a badge on the page early.
Current status, audit timelines and architecture documentation are available under NDA.
For your security team
Bring your CISO. We’ll bring the evidence.
Ask for the security pack: current audit status, timelines and architecture documentation, shared under NDA. Or connect one system and see the controls for yourself.
hello@aedeon.ai