Skip to content
Legal Centre/Trust & Security

Trust & Security

Version 1.0Effective 15 January 2026Last updated 15 January 2026

This Trust Centre summarises the controls we operate today. It is maintained by the Exeaura team and reflects app-visible practices, not independent certification.

1. Shared responsibility

Security is a partnership. EXEAURA is responsible for the security of the platform, the executive intelligence orchestration layer, and the infrastructure it runs on. You are responsible for keeping your credentials safe, enabling MFA where offered, choosing which content to upload, and reviewing AI output before you publish. This page describes the controls Exeaura operates and enables today. It is maintained by the Exeaura team and is not an independent certification.

2. Encryption

In transit
  • HTTPS used for public application traffic; configuration reviewed periodically
  • HTTP/2 and modern cipher suites
  • Certificates auto-rotated
At rest
  • Provider-managed encryption at rest for supported managed storage
  • Backup configuration and retention depend on the active service plan
  • Encrypted secrets vault for API keys

3. Authentication and access

Users
  • Email + password with password hashing
  • Google OAuth
  • Session tokens rotated on sensitive actions
  • Row-level security on every user-scoped table
Employees
  • SSO with hardware-key MFA
  • Least-privilege access to production
  • Break-glass access reviewed and logged
  • Access reviews every quarter

4. Infrastructure

Hosting
  • Managed edge hosting with global CDN
  • Production data services currently hosted in the Asia Pacific region
  • DDoS protection at the edge
Isolation
  • Per-tenant row isolation via RLS
  • Signed webhooks with HMAC verification
  • Least-privilege service roles

5. Monitoring and observability

Application
  • Application diagnostic logging
  • IGOF traces for every AI request
  • Operational logs subject to access controls
Operational
  • Multi-component health service
  • Operational event records and incident review
  • Critical incidents are prioritised for investigation

6. Availability and disaster recovery

Availability and recovery capabilities depend on the deployed services and active provider configuration. Any contractual Enterprise service levels are specified in an executed agreement.

7. Secure development

Code
  • Peer review on every change
  • Automated typecheck and lint on every push
  • Dependency vulnerability scanning
Runtime
  • Automated security linting on database schema
  • RLS-required-by-default check
  • Secrets never checked into source

8. Incident response

We follow a documented runbook: detect, triage, contain, eradicate, recover, post-mortem. Confirmed customer-impacting security incidents are notified without undue delay and within 72 hours where GDPR applies. Enterprise customers receive dedicated incident communication under their order form.

9. Responsible disclosure

If you believe you have found a vulnerability, please email support@yukta4u.com with reproduction steps and impact. We commit to acknowledging within 3 business days, working with you in good faith, and not pursuing legal action against researchers who follow this policy.

Please do not exfiltrate data, degrade service, or access accounts other than your own. Testing is out of scope for third-party services (LinkedIn, payment providers, model providers) — please report to them directly.

10. Compliance roadmap

Exeaura is building its compliance programme toward recognised assurance frameworks. Current controls, data-handling practices and contractual commitments are described on this Trust Centre; formal certifications will be stated here only after they are independently achieved.

11. Security contact

Security questions, vulnerability reports, or SIG/CAIQ requests: support@yukta4u.com.