Separate public and authenticated surfaces
Marketing has no application session, privileged database access or service-role credentials. Dashboard owns authenticated product work.
Security & trust
Trust starts with boundaries you can inspect.
The rebuild treats identity, tenancy, evidence provenance and honest degradation as product behaviour. This page distinguishes implemented foundations from launch claims.
Preview-stage disclosure
No certification is being claimed.
ARIA is not currently represented as SOC 2 or ISO 27001 certified. Production hosting, recovery, sub-processors and legal controls require their own accepted launch review. The statements below describe the rebuild’s enforced boundaries and target discipline.
Tenant ownership is explicit
Organisations, memberships and roles are application-owned records with row-level isolation as defence in depth.
Evidence retains identity
Material findings are designed to retain source identity, retrieval time, confidence and known gaps.
Human decisions remain human
ARIA is a research and review aid. It is not intended to make solely automated decisions with legal or similarly significant effects.
Secrets stay server-side
Provider, database, service-role and model credentials must never enter either browser application.
Failure must remain visible
Unavailable sources, provider errors and incomplete evidence are reported as degraded outcomes—not converted into success.