Security Policy

This page summarizes the technical and organizational measures AIQENmaintains to protect the AI Workforce platform (“the Platform”) and the data it processes. It is intended for prospective and existing customers evaluating our security posture, and is referenced by our Data Processing Agreement.

The Platform is multi-tenant: every organization’s data lives in the same database but is isolated from every other organization’s using PostgreSQL row-level security (RLS) policies enforced at the database layer, not just in application code. Every table holding organization data carries policies that scope reads and writes to the requesting user’s own organization membership, so a bug in application-layer authorization cannot by itself expose another tenant’s data.

• Data in transit is encrypted via TLS between your browser, our application, and our database and storage providers.
• Data at rest is encrypted at the infrastructure level by our database provider, Supabase.
• Passwords are never stored in plaintext; they are hashed by Supabase Auth using industry-standard password hashing.

• Platform access is scoped by organization membership and role. Administrative access to the internal admin console is governed by a dedicated role/permission system (admin users, roles, and granular permissions), replacing any static allow-list approach.
• Internal access to production data is restricted to authorized personnel on a need-to-know basis.
• Sensitive administrative actions are recorded in audit logs for traceability.

• Authentication endpoints (sign-in, sign-up, and password-reset flows across all portals) are rate-limited to deter credential-stuffing and brute-force attempts.
• Background job processing and workflow execution run through a monitored job queue with error logging, so failures are visible rather than silent.
• We monitor for platform errors via centralized error logging.

Database schema and access-control changes go through migration review before reaching production. We periodically review database security and performance advisors covering row-level security coverage, function permissions, and related configuration, and remediate findings as part of ongoing platform hardening.

If we confirm a security incident affecting customer data, we will investigate, take reasonable steps to contain and remediate it, and notify affected customers as described in our Data Processing Agreement.

If you believe you’ve found a security vulnerability in our website or the Platform, please report it to hello@aiqen.co with enough detail to reproduce the issue. Please report privately and give us a reasonable opportunity to investigate and remediate before any public disclosure. Please do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue.

Platform security is a shared responsibility. We secure the infrastructure, database, and application; your organization is responsible for managing who has access to your Platform account, using strong unique passwords, reviewing which third-party integrations and API keys are connected, and configuring your own workflow and AI automations responsibly, consistent with our Acceptable Use Policy.