SECURITY

How AIOS is secured

Last updated: 19 August 2026

AIOS holds your team’s tasks, documents, conversations and connected business tools, so we audit ourselves against a 40-point framework: the 30 checks a diligent security review asks of any SaaS, plus 10 we added for what AIOS actually is — an AI platform serving multiple customers. Every row is verified against the running codebase. Current position: 27 in place, 9 in progress (built, final step scheduled), 4 gated (the check applies to a feature not yet launched, and is a written launch requirement for it). Rows say “in progress” when they are — honesty is part of the standard.

Ask us about any row and we’ll show you the evidence, run your own security checklist against AIOS, or answer a due-diligence questionnaire: hello@cleverfox-ai.com.

Application & data security

The 20 security checks a diligent buyer's review asks of any SaaS.

1	No secrets in source control	In place	Full repository history swept — no credentials, ever. Secrets live in the deployment platform only.
2	No secret keys in the browser	In place	Only public-by-design configuration reaches the client; privileged keys are server-only.
3	Database row-level security	In place	Two independent layers: the application checks every request, and the database itself enforces workspace-scoped row policies — verified live on 19 Aug 2026 (a simulated outside account sees zero rows).
4	Server-side permission checks	In place	Every endpoint is gated server-side, and an automated census fails our build if a new endpoint ships without an access check.
5	Rate limiting	In place	Sign-in, password reset and AI endpoints are all throttled per account.
6	SQL injection	In place	No raw SQL anywhere — every query is parameterised through the data layer.
7	Input validation	In place	Schema validation with hard ceilings on every request body that reaches a paid API or an email.
8	XSS protection	In place	All rendered rich text — including AI output — passes through an industry-standard sanitiser, backed by a Content-Security-Policy.
9	Password storage	In place	Industry-standard hashing, fully delegated to our auth provider. No custom cryptography, no plaintext, anywhere.
10	Session security	In place	Cookie-based sessions; no tokens in browser storage.
11	Admin access control	In place	Three independent server-side layers gate administrative surfaces; role checks run per-request, never trusted from the client.
12	Cross-origin policy	In place	Strict same-origin; no wildcard or reflected origins.
13	Account verification	In progress	All accounts are provisioned by an administrator or email link — every route proves inbox control. Capturing the provider-side setting in configuration is the open step.
14	Non-enumerable records	In place	Records use random identifiers with ownership checks on writes, and the database-level row policies now refuse cross-workspace access regardless of any identifier a caller guesses.
15	Mass-assignment protection	In place	Writes copy only whitelisted fields; protected values are set server-side, last, so a request can never override them.
16	Webhook signature verification	Gated	No inbound webhooks exist today; the first one ships with signature verification as a launch requirement.
17	No internal error leakage	In place	No stack traces or internals reach clients; sign-in failures return one constant answer so account existence can't be probed.
18	Dependency vulnerabilities	In place	Zero known vulnerabilities in the production dependency tree, checked on every audit pass.
19	Password policy	In place	One minimum-length rule on every path that sets a password — including administrator-set ones.
20	Upload validation	In progress	Authenticated, workspace-scoped, size-capped uploads with active-content types refused; file URLs carry no personal information. Remaining refinements are documented decisions under review.

Privacy & legal

The 10 compliance checks, held to UK GDPR standards.

21	Privacy policy	In place	Published, linked from every entry point, and checked against the codebase — the processor list matches what the software actually calls.
22	Data collection disclosed	In place	What we collect, why, and for how long — including the honest negative: no analytics trackers, because none are installed.
23	AI use disclosed	In place	Every AI provider named; the policy says plainly that documents and voice notes are processed by them, and that AI output should be reviewed.
24	Processors disclosed	In place	Full processor list published, backed by an internal register recording each provider's retention and training position.
25	Real data deletion	In place	Deletion removes sign-in, uploaded files from storage, and personal identity on team content — with a per-step report, recorded in the audit log.
26	Storage privacy	In progress	Documents are served through authenticated, expiring links; media files use unguessable, PII-free addresses by documented design, under review.
27	Genuine testimonials	Gated	We display none — and our own marketing agent is instructed never to invent proof.
28	Fair cancellation	Gated	No self-serve billing yet; our published terms already promise cancellation will take no more steps than signing up.
29	Renewal reminders	Gated	Same gate: the reminder-before-renewal promise is published before the feature exists.
30	AI crisis safety	In place	A safety floor rides on every model call: a person in crisis gets real support routes, never a raw business reply — enforced at the server, tested in CI.

The 10 checks we added ourselves

Standard reviews treat AI as a chatbot feature. AIOS agents read mail and act in connected systems, and we serve many customers from shared infrastructure — so we hold ourselves to ten more.

31	Prompt-injection defence	In progress	External content entering a prompt (transcripts, uploaded documents) is explicitly fenced as evidence-not-instructions; extending the pass to every agent is scheduled.
32	Cross-tenant isolation testing	In progress	An automated census makes an ungated endpoint a build failure, and the database layer was verified live against a simulated outsider; a full per-endpoint adversarial pass is the remaining step.
33	AI provider data terms	In progress	Register written with each provider's training and retention position; formal verification of current terms in progress.
34	Backups & recovery	In progress	Automated backups run; a quarterly restore-test procedure is written and the first dated test is scheduled.
35	Audit logging	In place	Live since 19 Aug 2026: a tamper-resistant log of every administrative action and data export — its own administrators cannot edit it.
36	Offboarding & sessions	In progress	A written offboarding runbook, exercised for real in August 2026; account removal kills all sessions. MFA for administrators is the scheduled next step.
37	Security headers	In place	Content-Security-Policy, HSTS, clickjacking protection, strict referrer and permissions policies.
38	Terms of Service	In place	Published — acceptable use, your content stays yours, AI-output expectations, England & Wales law.
39	UK GDPR operations	In progress	Lawful bases published, retention schedule written, export and erasure implemented; registration check and formal breach-response naming in progress.
40	Disclosure & key management	In place	Published vulnerability-reporting route with response times; written access inventory and a rotation runbook for every credential.

Reporting a vulnerability

Email hello@cleverfox-ai.com with “SECURITY” in the subject — a human replies within 2 business days, and confirmed findings get a fix or a plan within 14. Details in the security policy in our repository. How we handle personal data is in the Privacy Policy.