Security
Trust is infrastructure.
Space compliance data is sensitive. We design for encryption, access control, EU-oriented residency, and AI that stays labeled — with claim hygiene, not badge theater.
Last reviewed · security.txt
EU-oriented posture
Hosting & monitoring designed for European data residency.
Encryption in depth
TLS in transit; AES-256-class encryption at rest where data is stored.
Human-supervised AI
ASTRA labeled as software — not legal advice; opt-in, audit trail.
SOC 2 roadmap
Controls work ongoing — we say planned, not certified.
Stack
Five layers. One posture.
Infrastructure, application, privacy, AI, and operations — how we protect operator data, layer by layer.
01 — Infrastructure
Where data lives and how it moves.
- EU-oriented hostingPrimary application and data plane designed for EU residency. We avoid ad-tech trackers that exfiltrate to third parties.
- Encryption at rest & in transitIndustry-standard TLS for traffic; server-side encryption for stored documents and database volumes.
- Edge protectionDDoS mitigation, modern TLS, and hardened edge delivery for public surfaces.
- Tenant isolationOrganization boundaries are enforced in application and data access — no shared tenant bags.
02 — Application
How people and APIs enter the system.
- AuthenticationHashed credentials, Google / enterprise SSO paths, multi-factor authentication where product surfaces require it.
- Role-based accessLeast-privilege roles per organization — viewers don’t become owners by accident.
- API & input hardeningRate limits, API keys, CSRF and injection defenses, server-side validation, strict security headers.
- Upload disciplineType and size checks before acceptance — no blind trust of file payloads.
- Continuous scanningDependency and secret scanning on deploy paths; vulnerable packages get blocked, not ignored.
03 — Privacy
GDPR as process posture — not a badge.
- Data minimizationCollect what the product needs; anonymize IPs where analytics run; delete on schedule.
- Field-level careEspecially sensitive fields (e.g. tax identifiers) get additional encryption beyond storage defaults.
- Rights that workExport and erasure paths designed for Art. 15 / Art. 20 style requests — not a PDF dead-end.
- Consent that means somethingGranular cookie consent; no third-party ad tracking; self-hosted analytics posture.
04 — AI (ASTRA)
Assistance, not authority.
- Labeled outputsAI-assisted content is marked. Art. 50-style transparency where it applies — not a formal certification claim.
- No training on your corpusCustomer data is not used to train foundation models for others.
- Human remains in controlDisclaimers: software is not legal advice. Critical decisions stay with counsel and operators.
- Audit trailAI interactions can be logged with context for internal review and accountability.
05 — Operations
What we watch and how we respond.
- Security-relevant loggingWho changed what, when, from which session context — for investigations that need a timeline.
- Anomaly signalsLogin and permission events monitored for patterns that look wrong.
- Error visibilityProduction errors surface to the team with EU-oriented monitoring residency where configured.
- Enterprise optionsSSO (SAML / OIDC), retention configuration, security contact, and incident escalation paths for larger orgs.
Found something?
Responsible disclosure keeps operators safe. We prefer researchers who report privately first.
Email security@caelex.eu. We aim to acknowledge reports within 48 hours and coordinate a fix before public write-ups. Policy pointers live in /.well-known/security.txt.
Please avoid testing that degrades service for other customers or accesses live personal data beyond what is necessary to demonstrate a finding.
Claim hygiene. We describe controls and process posture — not ISO/SOC certifications we have not completed. “EU-oriented” means we design for European residency and privacy rules; edge delivery and subprocessors are listed in legal docs when they apply. Software is not legal advice.
FAQ
Security — frequently asked questions
- Where is Caelex data hosted?
- Caelex is designed with EU-oriented hosting postures for GDPR alignment. See the security page for current infrastructure and encryption practices.
- How does Caelex handle AI transparency?
- AI-generated content is labeled; humans remain decision-makers; software is not legal advice. We pursue Art. 50-style transparency and an internal AI Act risk assessment — not a formal certification claim.
- Is customer data used to train AI models?
- Customer data is not used by Caelex to train foundation models. Inference uses third-party GPAI under product routing policies (e.g. EU-preferred paths for Atlas mandate chat).
- How do security researchers report issues?
- See caelex.eu/.well-known/security.txt for responsible disclosure.
Last updated:
Run compliance on a secure spine.
Book a consult or start with a free assessment — same security posture either way.