Security at the Heart of AIDU
Protecting our customers' business-critical email data, sales intelligence, and CRM information is our highest priority.
Our Commitment
AIDU's Security and Privacy teams establish policies and controls, monitor compliance, and maintain security and data protection standards to third-party auditors.
Governance
Security policies embedded into business operations
Compliance
Regular security audits and compliance monitoring
Oversight
Board-level oversight of security practices
Response
Incident response procedures and testing
Data Protection
We utilize AES-256 disk-level encryption to protect all customer data stored within our infrastructure. We apply industry-standard encryption to all information residing on our database volumes.
To further enhance security, specific sensitive data fields are encrypted at the application level before storage. Encryption keys are managed through a dedicated Key Management Service (KMS) featuring automated rotation and strict access controls.
Every connection to AIDU uses TLS 1.3 encryption. All API communications, webhooks, and data synchronization between AIDU and email providers are encrypted end-to-end. No unencrypted data transmission occurs.
Customer data is logically isolated with multi-tenant architecture ensuring complete separation between organizations. Access controls enforce strict data boundaries.
Role-based permissions ensure users only access authorized data. All administrative actions are logged and monitored.
Clear lifecycle policies govern data retention and deletion. Customer data is deleted upon request within 30 days.
Backup retention follows industry best practices with encrypted storage. No data sharing between customer organizations.
Product Security
Penetration Testing
- Annual third-party testing
- External researcher validation
- Vulnerability remediation
- Continuous testing lifecycle
Vulnerability Scanning
- Automated daily scans
- Library dependency monitoring
- Critical patches in < 24h
- Regular security updates
Secure Development
- Security-first SDLC
- Mandatory code reviews
- Static & dynamic testing
- Mandatory engineer training
API & Microsoft Integration
OAuth 2.0 authentication for Microsoft 365 integration. Webhook signature verification for all incoming events. Rate limiting prevents abuse. Input validation on all endpoints.
Infrastructure Security
Enterprise-Grade Cloud
AIDU runs on enterprise-grade cloud infrastructure with tier-1 security controls. Network segmentation and firewall protection isolate services.
Advanced Mitigation
DDoS mitigation protects against attacks. Intrusion detection systems monitor for threats 24/7.
Access Controls
MFA & RBAC
Multi-factor authentication (MFA) required for all user accounts. Role-based access control (RBAC) for granular permissions.
Least Privilege
Least-privilege access principles enforced. Session management with automatic timeouts for enhanced security.
Security Monitoring
- 24/7 security monitoring with dashboards
- Real-time alerting for suspicious activities
- Centralized logging with audit trails
- SIEM integration for log analysis
- Automated threat detection and response
Business Continuity
- Automated daily encrypted backups
- Disaster recovery procedures tested quarterly
- High availability with automatic failover
- Geographic redundancy across multiple regions
- RTO (Recovery Time Objective) under 4 hours
Employee Security
Background checks for all employees with access to customer data. Mandatory security awareness training quarterly.
Phishing simulation exercises. Secure coding training for developers. Immediate access revocation upon termination.
Microsoft Integration
OAuth 2.0 token-based authentication—no password storage. Granular permission scopes request only necessary access.
User consent required for mailbox access. Regular token validation and refresh. Webhook validation and signature verification.
AI Data Processing
Email processing is conducted within secure, isolated environments leveraging enterprise-grade infrastructure. We utilize Azure OpenAI for analysis, ensuring that customer data remains within our private tenant and is never used to train public models.
Email content is transient and is not stored longer than necessary for immediate processing. All CRM synchronizations are performed via encrypted connections.
Payments
Stripe payment processor (PCI Level 1 certified). No storage of credit card data in AIDU systems. Secure payment flows with tokenization.
Data Privacy
Compliant with EU-US data transfer frameworks. GDPR Article 30 records of processing maintained. DPAs available.
Compliance & Certification
"We are committed to the highest levels of security and are currently formalizing our posture through industry-leading frameworks."
Third-Party Security
We maintain a rigorous Vendor Management Program to ensure our partners adhere to the same high security standards we set for ourselves.
Microsoft Azure
Infrastructure & AI
Secure, isolated processing
Stripe
Payments
PCI-DSS Level 1 compliant
Nango
Integrations
Secure CRM authentication