> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asteragents.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security & Compliance
> Comprehensive security and compliance information for Aster Agents platform
# Security & Compliance
Our customers entrust Aster Agents with sensitive business data. Protecting that data is our highest priority. This document outlines the technical, organizational, and procedural controls we have in place to keep your information secure.
## Infrastructure Security
Aster Agents runs entirely on trusted, SOC 2–certified cloud vendors:
* **Vercel** for frontend hosting, serverless Node API functions, and JavaScript tool execution
* **Modal** for Python tool execution back-end (legacy and specialized tools)
* **[Neon (PostgreSQL)](https://neon.tech/security)** – serverless Postgres platform (recently acquired by Databricks)
* **Isolated Environments** – Production, staging, and development environments are fully separated at the network and resource level.
* **Least-Privilege IAM** – Each service function executes with the minimal scope required to perform its task. No long-lived root keys are used.
## Network Security
* **Encryption in Transit** – All traffic is forced over TLS 1.2+ with modern cipher suites.
* **Web Application Firewall (WAF)** – Traffic to Vercel is protected by built-in DDoS mitigation and WAF rules.
* **IP & Rate Limiting** – Abuse-prevention rules throttle excessive or malicious requests.
## Data Security
* Databases and file storage (Cloudflare R2) use AES-256 server-side encryption
* Modal persistent volumes are encrypted by default
* Automated daily backups with 30-day retention and geo-redundancy
* Quarterly DR drills validate our backup restoration procedures
* **Data Residency** – All data is stored exclusively in USA-based regions unless otherwise agreed.
## Application Security
We use [Clerk](https://clerk.dev) for authentication, supporting:
* SSO/SAML integration
* Multi-factor authentication (MFA)
* Organization-scoped role-based access control (RBAC)
* Session management and token validation
Learn more about configuring roles and permissions in the [Roles & Permissions](/settings/roles-permissions) documentation.
* **OWASP Alignment** – The codebase is reviewed against OWASP Top 10 risks
* **Secure Defaults** – Common pitfalls (XSS, CSRF, SQLi) are mitigated by secure defaults in Vercel Functions and parameterized queries via Drizzle ORM
* **Secrets Management** – API keys, database credentials, and other secrets are stored only in Vercel & Modal encrypted secret managers—never in code or CI logs
* **Dependency Scanning** – GitHub Dependabot & Snyk automatically scan for vulnerable packages; critical findings are patched within 24 hours
* **CI/CD Checks** – Each pull request runs automated tests, type-checks, and linting before merge
## Compliance
View our comprehensive **Trust Center** for real-time compliance status, security policies, and certification details.
| Framework | Status | Notes |
| ------------- | --------------- | -------------------------------------------------------- |
| SOC 2 Type II | **In Progress** | Currently in observation period, report expected Q1 2026 |
| GDPR | **Compliant** | DPA & SCCs available on request |
| HIPAA | **Not Covered** | PHI should not be stored in Aster Agents |
**Data Processing Agreement (DPA)** and **Standard Contractual Clauses (SCCs)** are available upon request for enterprise customers requiring GDPR compliance documentation.
## Privacy & Data Ownership
You bring your own AI API keys and own your data. We will never train 3rd-party models on your private data.
Each organization's data is logically separated using row-level security and unique encryption keys.
* **Right to Deletion** – Users can request deletion of personal data at any time through our data subject request process.
## Vulnerability Management
Real-time scanning for vulnerabilities across our infrastructure and application stack.
* Critical security patches applied within 24 hours
* High/medium-severity patches within 7 days
* All patches tested in staging before production deployment
Public bug-bounty program incentivizes responsible disclosure (coming soon).
## Incident Response
**24×7 Monitoring** – Real-time logs, metrics, and alerts for abnormal behavior with documented runbooks and an on-call rotation ensure rapid response.
* **Customer Communication** – Incidents affecting customer data will be disclosed within 72 hours, per our SLA.
* **Incident Classification** – Clear severity levels with defined response times and escalation procedures.
## Business Continuity
* **Redundancy** – Stateless services automatically scale across multiple availability zones.
* **Disaster Recovery** – Quarterly DR drills validate our backup restoration procedures.
* **Service Level Agreements** – 99.9% uptime SLA with defined response times for different incident severities.
## Subprocessors & Trust Centers
Below is a list of our key infrastructure and security-critical vendors along with links to their Trust Centers or SOC 2 reports:
| Vendor | Purpose | Trust Center / SOC 2 |
| --------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------- |
| **Vercel** | Front-end hosting, Node.js serverless functions & JavaScript tool execution | [Security](https://vercel.com/security) |
| **Modal** | Python serverless execution backend (specialized tools) | [Security Guide](https://modal.com/docs/guide/security) |
| **Neon (PostgreSQL)** | Serverless Postgres database hosting (part of Databricks) | [Security](https://neon.tech/security) |
| **Cloudflare R2** | File storage & CDN | [Trust Hub](https://www.cloudflare.com/trust-hub/) |
| **Clerk** | Authentication & RBAC | [Security Overview](https://clerk.com/docs/security/overview) |
We review each sub-processor’s security posture annually and maintain DPAs with all vendors handling customer data.
## Security Architecture
```mermaid theme={null}
graph TB
A[Customer Browser] -->|TLS 1.2+| B[Vercel CDN/WAF]
B --> C[React Frontend]
C -->|Authenticated Requests| D[Node.js API Functions]
D -->|JWT Validation| E[Clerk Auth Service]
D -->|Encrypted Connection| F[PostgreSQL Database]
D -->|High-Performance Tools| J[JavaScript Tool Execution]
D -->|Secure API Calls| G[Modal Python Backend]
G -->|Isolated Execution| H[Specialized Tool Functions]
J -->|Direct Database Access| F
G -->|Encrypted Storage| I[Cloudflare R2]
style E fill:#e1f5fe
style F fill:#f3e5f5
style I fill:#fff3e0
```
## Contact & Reporting
General security questions: **[security@asteragents.com](mailto:security@asteragents.com)**
Responsible disclosure: **[security@asteragents.com](mailto:security@asteragents.com)**
Please include:
* Detailed description of the vulnerability
* Steps to reproduce
* Potential impact assessment
**Response Time**: We acknowledge all security reports within 24 hours and provide regular updates throughout our investigation process.
***
*Last updated: July 2025*
*For questions about this security documentation or to request additional compliance information, please contact our security team.*