Trust & Security
How Aletheia Reliability LLC protects the failure-investigation data our customers trust us with.
Security practices
Aletheia is built for industrial manufacturers with regulated and safety-critical operations. Core security measures include:
- Enterprise SSO (SAML/OIDC via WorkOS) — where SSO is used, your identity provider's own MFA and conditional-access policies govern those sign-ins. Aletheia does not maintain a separate MFA enrollment surface and adds no second factor to local password accounts.
- Role-based access controls with least-privilege defaults
- TLS 1.2 or higher encryption for all data in transit
- Encryption at rest across database and file storage (Neon and Cloudflare)
- Authenticated sessions via secure, HTTP-only JWT tokens
- Bcrypt password hashing for credential storage
- Audit trails recording user actions, with soft deletion that preserves investigation history
- Secret scanning with push protection on our source repositories
- Enforcing Content Security Policy and hardened security headers
Data residency & Bring Your Own Database
Every customer's Investigation Data lives in its own isolated PostgreSQL database — there is no shared multi-tenant data store. Customers choose between two deployment models:
- Bring Your Own Database (BYODB): connect a PostgreSQL database that you host and control. Your Investigation Data stays in your infrastructure, under your retention, backup, and residency policies.
- Managed: Aletheia provisions a dedicated, isolated database per customer on Neon, hosted in the United States (US East region).
File attachments are stored with tenant-scoped path prefixes, and tenant isolation is enforced at the database layer with application-layer controls on every request.
AI use & governance
Aletheia uses OpenAI's API to generate analysis suggestions — follow-up questions, candidate cause trees, draft action items, and a draft RCFA summary. Each request carries data from the investigation being analyzed and, where an investigator has linked up to three related investigations from the same site, a limited text extract of those investigations (never their attachments). Investigation Data submitted for analysis is handled as described in the subprocessor table below: API access only, not used for model training, and subject to OpenAI's 30-day abuse-monitoring retention. Our Privacy Policy (§4) covers AI data handling in detail.
- All AI output is a draft.Suggested root causes and action items become part of the RCFA record only when an investigator reviews and explicitly promotes them. An AI-drafted RCFA summary goes straight into the RCFA's summary field, where the investigator can edit or replace it.
- Provenance recorded: Every cause-tree node records whether it originated from AI or from a person. It is not shown as a label on the node itself.
- Know the limits:cause-tree nodes without a cited source represent the model's own inference and should be verified before relying on them. The platform marks cited nodes so reviewers can tell the difference.
Subprocessors
Aletheia uses the following third-party subprocessors to deliver the platform. Material changes to this list are communicated with reasonable advance notice.
| Subprocessor | Purpose | Data touched | Region | DPA status |
|---|---|---|---|---|
| Vercel, Inc. | Application hosting | Application requests, runtime logs | United States | DPA in place |
| Neon, Inc. | PostgreSQL database hosting (isolated per-tenant databases) | All Investigation Data | United States | DPA in place |
| Cloudflare, Inc. (R2) | File and attachment storage (tenant-scoped prefixes) | Uploaded attachments | United States | DPA in place |
| OpenAI, LLC | AI analysis (API; not used for model training; 30-day abuse-monitoring retention) | Investigation Data submitted for analysis | United States | DPA in place |
| Resend, Inc. | Transactional email delivery | Recipient email addresses and message content | United States | DPA in place |
| WorkOS, Inc. | Enterprise SSO and authentication | Authentication identifiers, SSO metadata | United States | DPA in place |
| Upstash, Inc. | Rate limiting and caching (Redis) | Rate-limit keys containing user identifiers and emails | United States | DPA in place |
| Sentry (Functional Software, Inc.) | Application error monitoring | Error reports: the error's type and message, where in the code it occurred, the page path, and browser details. Sentry also sees the IP address the report comes from. We add no names, email addresses, cookies or record contents; an error's own message is sent as written. | United States | DPA accepted |
Compliance posture
- 21 CFR Part 11-aware: the platform maintains audit trails and soft-deletion designed with Part 11 expectations in mind. Aletheia does not claim Part 11 certification — suitability assessment remains the customer's responsibility.
- GAMP 5: Aletheia positions as a Category 4 (configured product) for customer validation purposes.
- SOC 2: not yet certified; a SOC 2 audit is on our roadmap. Our security package (below) documents current controls in the meantime.
Service status
Live platform availability and incident history are published at status.aletheiarcfa.com.
Request the security package
A complete security package — including our CAIQ responses and policy set — is available to prospective and current customers under NDA. To request it, or to report a security concern, contact security@aletheiareliability.com.