Skip to main contentSkip to main content
Security & Compliance

Your compliance data
in safe hands

Enterprise-grade security for the most sensitive data in space regulation. Hosted in the EU, end-to-end encrypted, with no third-party tracking.

GDPR Compliant
EU AI Act
AES-256 Encrypted
SOC 2 (Planned)
Infrastructure

Hosted in the EU. Encrypted everywhere.

All data stays within the European Union. Every layer of our infrastructure is encrypted and secured.

EU-Only Hosting

Our entire infrastructure is operated within the EU. Your data never leaves European soil.

Encrypted Database

All data is encrypted at rest and in transit — using industry-standard AES-256 encryption.

Secure File Storage

Documents and uploads are stored with server-side encryption in EU data centers.

DDoS Protection & CDN

Automatic attack protection, SSL encryption, and a global edge network for fast load times.

Application Security

Multiple Layers of Protection

From authentication to API access — your data is protected by multiple independent security layers.

Secure Authentication

Passwords are hashed following best practices. Sign in with Google, Enterprise SSO, or email — with multi-factor authentication.

Role-Based Access Control

Every team member only sees what they need to. Granular roles from Viewer to Owner — isolated per organization.

API Security

Multi-layered rate limiting, API key authentication, and protection against common attack vectors like CSRF and injection.

Input Validation

Every input is validated server-side. Strict Content Security Policies and modern security headers provide additional protection.

Upload Verification

Uploaded files are checked for file type and size before being accepted. No blind trust.

Automated Security Scans

Our code is automatically scanned for vulnerabilities, secrets, and insecure dependencies on every deployment.

Data Protection

GDPR Compliant by Design

Data protection is not an afterthought. Every feature is built with privacy-by-design principles.

Sensitive Data Encrypted

Especially sensitive fields like tax IDs or bank details are additionally encrypted with AES-256 — not just the database.

Data Minimization

We only collect what is truly necessary. IP addresses are automatically anonymized, outdated data is regularly deleted.

Cookie Consent

Granular consent management with real opt-in. No tracking without your explicit permission.

Data Portability

Your data belongs to you. Full export at any time in accordance with GDPR Art. 15 and Art. 20 — in standard formats.

Right to Erasure

Upon request, all your data is completely and irrevocably deleted — across all connected systems.

No External Tracking

We exclusively use self-hosted analytics. No Google Analytics, no third-party trackers, no data selling.

AI Security

EU AI Act Compliant

Our AI assistant ASTRA meets the EU AI Act requirements for transparency and human oversight.

ASTRA — Responsible AI

Transparency

AI-generated content is always clearly labeled — in accordance with EU AI Act Art. 50

No Training on Your Data

Your data is never used to train or improve AI models

Human Remains in Control

All AI responses include a disclaimer that they do not constitute legal advice

Explicit Consent

AI features require an explicit opt-in before each use

Complete Audit Trail

Every AI interaction is logged with timestamp and context — for full traceability

Monitoring

Audit & Monitoring

Full transparency over every action on the platform — with real-time monitoring.

Comprehensive Logging

Every security-relevant action is logged — who changed what, when, and from which device.

Security Monitoring

Login attempts, permission changes, and data access are monitored and flagged when anomalies are detected.

Real-Time Error Monitoring

Errors are detected in real time and reported to our team — with EU data residency for monitoring data.

High Availability Infrastructure

Enterprise infrastructure with automatic failover and zero-downtime deployments.

Enterprise

Built for the Highest Standards

Advanced security features for organizations that make no compromises.

Single Sign-On

Seamless login through your existing identity provider — SAML and OpenID Connect supported.

Custom Retention Policies

Configurable data retention to match your organization's requirements.

Dedicated Security Contact

Direct line to our security team for questions, incidents, and coordination.

Incident Response SLA

Defined response times for security incidents with clear escalation paths.

Security Assessments

Regular security reviews and vulnerability assessments — with remediation tracking.

Responsible Disclosure

Found a vulnerability? Report it to security@caelex.eu. We acknowledge reports within 48 hours and work with researchers to resolve issues responsibly.

Organization Isolation

Complete data separation between organizations. No shared resources, no data leakage between tenants.

Security researchers: See our security.txt for responsible disclosure information.

Ready for secure space compliance?

Start with a free assessment or talk to our team about enterprise security.