Security is the product.

Compliance

• Security review — vendor security questionnaires, architecture notes, and relevant reports are available under NDA.
• GDPR + CCPA — DPA available pre-sales. EU representative listed in DPA.
• HIPAA — BAA available for healthcare customers. Aleq's per-tenant isolation supports HIPAA-grade obligations.
• PCI-DSS — Aleq does not store cardholder data. Card data is tokenized at point of capture by our PCI-Level-1 payment processor.

Encryption

• At rest — AES-256-GCM with per-tenant data encryption keys. Keys are managed in AWS KMS with HSM-backed master keys.
• In transit — TLS 1.3 with forward secrecy. HSTS enabled with 2-year max-age.
• Backups — encrypted with the same per-tenant keys. Retained 90 days.

Audit signatures

Every journal entry posted by Aleq is signed at the time of post with an ed25519 keypair held in HSM. Period closes are sealed with an aggregate signature over the entire period's signed entries. Auditors can verify cryptographically that no entries have been altered after signing.

The shape of that verification:

• What is signed — the hash of the entry's payload, bound to its action ID. Change any field of a posted entry and the payload no longer hashes to the value that was signed.
• What it is checked against — the ed25519 public key paired with the signing key. The private key stays in the HSM; the public key is all anyone needs to check a signature.
• What the period seal adds — the seal signs over the set of signed entries in that period, so it catches what a per-entry check can't: a line added to a closed period, or a line removed from one.
• What an auditor needs from us — the period export carrying each entry with its signature and action ID, plus the public key to check them against.

Not published yet: the public key, the exact export format the signatures cover, and a verifier an auditor can run without us. A claim like this should be checkable without our help. Until it is, verification runs through security@aleq.com.

Access controls

• SSO — SAML 2.0 and OIDC supported (Okta, Azure AD, Google Workspace).
• SCIM — automatic user provisioning and deprovisioning.
• RBAC — granular, per-action permission model. Standard roles + custom role builder.
• MFA — required for all human users on privileged actions. Hardware security keys supported.

Vulnerability disclosure

If you believe you've found a security vulnerability in Aleq, please email security@aleq.com. We acknowledge reports within 24 hours and remediate critical issues within 14 days.

We operate a coordinated disclosure program. Eligible reports receive bounties from $500 to $25,000 based on severity and impact. Email security@aleq.com for scope and rules.

Incident response

Aleq runs continuous automated security monitoring with on-call response. In the event of a customer-impacting security incident:

• Initial customer notification within 24 hours.
• Status updates every 4 hours during the active phase.
• Final post-incident report within 5 business days, including cause, scope, remediation, and prevention measures.

Penetration testing

Aleq commissions an annual external penetration test by an independent security firm. Customers can request the executive summary under NDA.