Everything your security review will ask for
Send us your questionnaire and we will answer it in writing, early and in full. This page covers how we handle your data as a company, what controls exist in AION Nexus today, what we send under NDA, and exactly where the assurance work stands.
AION Nexus is pre-GA. The framework work described here is readiness, not attestation. No audit report has been issued.
How this company handles your data
Separate from anything the product does. AION Global Inc. is a federal Canadian corporation, so this is the law that applies to us whether or not you ever use AION Nexus.
PIPEDA and Quebec Law 25
Canadian federal private-sector privacy law governs how we collect, use and disclose personal information, and Law 25 adds obligations where Quebec residents are involved. Our privacy policy sets out the basis for each purpose, and how to make an access or deletion request.
CASL for anything we send you
Canada's anti-spam legislation requires consent before commercial electronic messages, an identifiable sender and a working unsubscribe. The contact form records consent as its own explicit action.
GDPR where it applies
If you contact us from the European Economic Area or the United Kingdom, we handle your enquiry on the basis of legitimate interest and honour the data-subject rights that follow, including access, rectification and erasure.
What this website itself runs on
The site is hosted on Hostinger behind Cloudflare. It sets no analytics or advertising cookies, so there is no consent banner to dismiss. The contact form is part of this theme: a submission is emailed to us and is never stored in the website database.
The controls that exist in the product today
These are summarized from the platform page, so the two cannot drift apart. Each one is implemented in code and covered by tests. External assessment is scheduled work, and the roadmap below says where it stands.
Tenant isolation enforced twice
A row-level security policy on every tenant-scoped table, plus independent scoping in the application. A test running against real PostgreSQL attempts a cross-tenant read on every build, and a continuous-integration ratchet stops a new table being added without a policy.
Field-level encryption with versioned keys
Personal, financial and identity-verification data, and document contents, are encrypted with AES-256-GCM. Keys are versioned, so a rotation re-encrypts existing data as well as new writes.
Hash-chained audit trail
Audit records are hash-chained per tenant, so an edit or deletion breaks the chain and is detectable. Updates record which fields changed, never the values, so the audit log never becomes a second copy of your data.
Segregation of duties
Nineteen permission domains with seeded roles including Compliance Officer, Auditor and Risk Analyst. Role changes are themselves subject to maker-checker, so an administrator cannot quietly grant themselves a capability.
Credentials you continue to own
Vendor credentials sit in a bring-your-own-key vault using envelope encryption backed by a managed key service. Revoking a credential severs the ability to execute against that provider.
Authentication and privacy operations
Time-based one-time-password multi-factor authentication and tiered rate limiting, with right-to-erasure workflows, records of processing activity, impact-assessment templates and retention policies built in.
What we will send you under NDA
A security review needs documents. These exist today, and we send them before any commercial conversation, gap analysis included.
Control matrix
Control by control: what is implemented, what is designed but not built, and what is neither.
Gap analysis
The same matrix read the other way round: what an assessment would find missing today, and what closing each item would take.
Technical evaluation brief
Architecture, data model, permission model and integration posture, written for your engineers.
OpenAPI specification
The full API surface, 301 endpoints across 137 data models, so your team can assess it directly.
Assurance roadmap
Where each piece of external assurance stands today, and what closes it. A security reviewer establishes all of this in the first call, so it is here instead.
- SOC 2: readiness complete, audit next The control matrix, evidence and gap analysis are done and available under NDA. The audit itself has not been performed and no report has been issued, so we describe the product as neither certified nor compliant.
- External penetration test: scoped, runs before production The scope and runbook are written and vendor selection is underway. The test and its remediation both come before the first production deployment.
- Production environment: infrastructure written, applied at first deployment The product runs in development, continuous integration and self-hosted staging today. Infrastructure-as-code for the target region is written and ready to apply; it goes up with the first customer.
- Data residency: Canadian by design, confirmed at deployment Canadian residency is the intended default and the infrastructure is written for it. We will put a hosting region in a contract once that infrastructure is applied and we can evidence it.
- ISO 27001 and PCI DSS: not in current scope Neither is planned for the first release. Where card data is involved it stays with the payment processor and never reaches our servers. That is a design decision, so confirm it against your own requirements.