Security

Last Updated: 26 July 2026

This page states what is actually in place today, not a roadmap. Where a control is partial or pending we say so - an assurance product that overstates its own security is worth nothing. If you are carrying out due diligence and need something not covered here, email support@aionatech.com.

1. Who we are

AIONA LTD, registered in England & Wales, company number 16606520. Registered office: 128 City Road, London, EC1V 2NX. Registered with the Information Commissioner's Office, registration number ZC189017.

2. Where your data lives

Application and database: Fly.io, London, United Kingdom (region lhr).
Documents you upload: Google Cloud Storage, europe-west2 (London).
Document data extraction: Google Document AI, EU region.
Marketing website: Netlify.
Error monitoring: Sentry, EU region - reports are scrubbed of personal data before they are sent.

A full sub-processor register, including the purpose and location of each, is published in §5 of our Privacy Policy.

3. Tenant isolation

Every firm's data is separated from every other firm's. That separation is enforced in two independent places: in application logic on every query, and by PostgreSQL row-level security policies on tenant tables, so a query that omits its tenant context returns nothing rather than returning another firm's records.

The application connects to the database as a least-privilege role that cannot create, alter or drop tables, and cannot bypass those row-level policies.

4. The ledger cannot be quietly edited

This is the control the product is built around, and it is enforced by the database itself rather than by application code that could be bypassed:

A posted journal entry cannot be modified or deleted. Corrections are made by reversal, which leaves both entries visible.
Audit events are append-only - they cannot be updated or deleted.
Every posted journal carries a SHA-256 hash chained to the previous entry, so any later alteration is detectable rather than merely discouraged.
The only permitted exception is a one-way anonymisation of a personal identifier when a data subject exercises their right to erasure, which is itself recorded in the audit trail.

5. Access and authentication

Passwords are hashed with bcrypt. We never store them in a recoverable form and cannot see them.
Role-based permissions: administrator, accountant, and read-only auditor.
Repeated failed sign-ins temporarily lock an account.
Sign-up is closed during the founding-cohort phase; access is by invitation only.

6. Encryption

All traffic is served over TLS (HTTPS). The application is not reachable over plain HTTP.
Data is encrypted at rest by the underlying platforms (Fly.io volumes, Google Cloud Storage).
Third-party credentials you connect - such as accounting or banking integration tokens - are encrypted by us before storage, using a key held outside the database.

7. Backups and recovery

The database is backed up nightly, encrypted with AES-256. Backups are restore-tested automatically - each nightly job restores the dump into a clean database and verifies record counts, because an untested backup is an assumption rather than a safeguard. Backups are retained for 30 days.

8. Monitoring

Automated availability checks every 30 minutes against the application, portal and website.
Application errors are captured with full diagnostic context and alert us by email.
Continuous automated security scanning of our code and dependencies, including secret detection, on every change.

9. What is not in place yet

Stated plainly, because you will ask:

No ISO 27001 or SOC 2 certification. We do not claim either. The controls above are real, but they have not been audited by a third party.
No multi-factor authentication on user sign-in yet.
Single production instance. Suitable for a founding cohort; we will move to redundant instances as the client base grows.
Live HMRC submission is not enabled - VAT, RTI and CT600 output is prepared for you to file through your existing route while our HMRC software recognition is pending.

10. Service status and incidents

We monitor availability automatically every 30 minutes. We do not yet publish a live status page - with a founding cohort of ten practices, we tell you directly. If the Service is materially unavailable or an incident affects your data, we email the named contact at your firm, and we will publish a written post-incident note on request. A personal-data breach is notified in line with our Data Processing Agreement and UK GDPR Article 33 timelines.

11. Reporting a vulnerability

If you believe you have found a security issue, please email support@aionatech.com with the details. We will acknowledge within two working days. Please give us a reasonable opportunity to fix the issue before disclosing it publicly. Our machine-readable policy is published at /.well-known/security.txt.

12. Your data is yours

You can export your ledger, documents and audit trail at any time from inside the product, in open formats, with no exit fee. See our Data Processing Agreement for deletion and return commitments on termination.