Skip to main content

​
Security & Compliance

Our customers entrust Aster Agents with sensitive business data. Protecting that data is our highest priority. This document outlines the technical, organizational, and procedural controls we have in place to keep your information secure.

​
Infrastructure Security

Cloud Providers

Aster Agents runs on SOC 2 Type II–certified cloud vendors:
  • Vercel for frontend hosting, serverless Node API functions, and JavaScript tool execution
  • Modal for Python tool execution back-end (legacy and specialized tools)
  • Neon (PostgreSQL) – serverless Postgres platform (part of Databricks)
See Subprocessors for the full vendor list and each one’s current status.
  • Immutable Deployments – Every commit builds to its own immutable, independently addressable deployment. Production is a pointer to a specific build, so any release can be rolled back instantly.
  • Least-Privilege IAM – Each service function executes with the minimal scope required to perform its task. No long-lived root keys are used.

​
Network Security

  • Encryption in Transit – All traffic is forced over TLS 1.2+ with modern cipher suites.
  • Web Application Firewall (WAF) – Traffic to Vercel is protected by built-in DDoS mitigation and WAF rules.
  • IP & Rate Limiting – Abuse-prevention rules throttle excessive or malicious requests.

​
Data Security

Encryption at Rest

  • Databases and file storage (Cloudflare R2) use AES-256 server-side encryption
  • Modal persistent volumes are encrypted by default

Backup & Recovery

  • Neon’s continuous point-in-time restore lets us recover the database to any moment within the retention window
  • Snapshot branches are taken before any schema migration, so changes can be rolled back
  • Data Residency – All data is stored exclusively in USA-based regions unless otherwise agreed.

​
Application Security

We use Clerk for authentication, supporting:
  • SSO/SAML integration
  • Multi-factor authentication (MFA)
  • Organization-scoped role-based access control (RBAC)
  • Session management and token validation
Learn more about configuring roles and permissions in the Roles & Permissions documentation.
  • OWASP Alignment – The codebase is reviewed against OWASP Top 10 risks
  • Secure Defaults – Common pitfalls (XSS, CSRF, SQLi) are mitigated by secure defaults in Vercel Functions and parameterized queries via Drizzle ORM
  • Secrets Management – API keys, database credentials, and other secrets are stored only in Vercel & Modal encrypted secret managers—never in code or CI logs
  • Dependency Scanning – GitHub Dependabot alerts are enabled on the codebase and continuously scan our dependency tree for known vulnerabilities
  • Build Verification – The production build runs a TypeScript compile step; a build that fails is never promoted to production

​
Personnel Security

  • Background Checks – All employees and contractors with access to customer data undergo pre-employment background screening.
  • Security Awareness Training – All personnel complete security awareness training.
  • Confidentiality Agreements – All employees and contractors with access to customer data are bound by written confidentiality obligations as a condition of that access.

​
Logging & Monitoring

  • Audit Logging – Platform activity is logged across the application, compute, and database layers.
  • Retention – Audit logs are retained for 90 days.
  • Customer Access – Customers can request an export of the audit logs relating to their organization by contacting security@asteragents.com.

​
Compliance

Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) are available upon request for enterprise customers requiring GDPR compliance documentation.

​
Privacy & Data Ownership

Customer Ownership

You bring your own AI API keys and own your data. We will never train 3rd-party models on your private data.

Data Isolation

Every record is scoped to an organization ID. All API routes and tool executions authenticate through Clerk and resolve the caller’s organization before any query runs, so data is never returned across organization boundaries.
  • Right to Deletion – Users can request deletion of personal data at any time through our data subject request process.
  • Portability – Prompts, skills, and tool schemas are stored in open formats and retrievable through the public API at any time. See Exporting Your Agents for the scripts that pull an agent into a portable bundle and run it on Anthropic’s infrastructure instead of ours.

​
Vulnerability Management

1

Continuous Monitoring

Dependabot continuously scans our dependency tree, and our infrastructure providers monitor the platform layers they operate.
2

Patch Management

Our remediation targets are 24 hours for critical-severity findings and 7 days for high and medium severity. Patches ship through the same build and review path as any other change.
3

Responsible Disclosure

Security researchers can report vulnerabilities directly to security@asteragents.com. We acknowledge every report within 24 hours and will not pursue legal action against good-faith research.

​
Incident Response

Platform Monitoring – Vercel and Neon provide continuous logging, metrics, and alerting across the compute and database layers. Deployments are immutable and independently addressable, so a bad release can be reverted in seconds.
  • Customer Communication – Our policy is to notify affected customers within 72 hours of becoming aware of an incident that involves their data.
  • Reporting an Incident – If you observe something that looks like a security incident, contact security@asteragents.com. We acknowledge reports within 24 hours.

​
Business Continuity

  • Redundancy – Stateless services automatically scale across multiple availability zones.
  • Disaster Recovery – Database recovery relies on Neon’s point-in-time restore; application code is redeployable from source at any prior commit.
  • Availability – We target 99.9% availability. Enterprise customers can negotiate a contractual SLA with defined severity levels and response times.

​
Subprocessors and Trust Centers

These are the vendors we engage to process customer data on your behalf, with their SOC 2 Type II status and Trust Center links.

​
Core Infrastructure

Every organization’s data passes through these vendors.

​
Tool Providers

These vendors receive only what an agent passes in an individual tool call — a search query, a URL, an email address to verify. They do not hold or store your data, though a tool call may include content drawn from it.
Not a subprocessor: services you connect with your own credentials — your AI provider keys, CRM, accounting system, file storage, database connections, and any data-lookup or enrichment service you enable as an integration — are not subprocessors. You hold those credentials and the relationship with that provider, and data moving between them and your agents is governed by your agreement with them, not ours.
We review each sub-processor’s security posture annually and maintain DPAs with all vendors handling customer data.

​
Security Architecture

​
Contact & Reporting

Security Team

General security questions: security@asteragents.com

Vulnerability Reports

Responsible disclosure: security@asteragents.comPlease include:
  • Detailed description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment
Response Time: We acknowledge all security reports within 24 hours and provide regular updates throughout our investigation process.
Version 1.0 · Last updated: 2026-08-12 For questions about this security documentation or to request additional compliance information, please contact our security team.