Security at ilion

Every organization’s data is isolated by organization ID at the database layer (PostgreSQL row-level security) and again in the application layer. Isolation is enforced by automated tests in CI, including cross-tenant red-team tests, on every change.

All traffic is encrypted in transit (TLS 1.2+). Data is encrypted at rest by our database and storage provider (AES-256). Stored credentials for connected systems — mailbox tokens, CRM and telephony connections, webhook signing secrets — carry a second layer of AES-256-GCM encryption applied by the application, so they are unreadable even from a database row.

Primary data storage runs in the EU (AWS eu-west-1, Ireland) and application functions are pinned to the EU (Dublin). See the subprocessor list for where each optional integration processes data.

AI agents propose; humans approve. Changes agents suggest go through an approval queue, and no outbound communication is ever sent without an explicit human action. Model providers are contractually barred from training on your data.

Operational logs are automatically minimized on a schedule: AI-run inputs and outputs are redacted of personal data after 90 days, error logs are deleted after 90 days, and audit trails are kept 2 years for accountability. Windows are configurable for enterprise agreements.

Record-level change history captures who changed what and when — humans, agents, and API alike. Vendor administrative access to a customer organization requires a stated reason and is itself logged.

Role-based access within each organization (owner / member, with an optional small-team mode that widens configuration without widening governance) gates organization-wide settings, secrets, and member management. Passwords require 12+ characters, two-factor authentication can be required workspace-wide, and sign-in can be restricted to company email domains.

Administrators can export the organization’s core records as structured JSON at any time, in the product, with no ticket. Today that export covers the main record types with a per-type row cap; an unlimited export covering every table is scheduled. Easy exit is part of the trust model, so we would rather state its current edges than imply it has none.

A platform-wide and per-organization kill-switch can instantly halt all outbound email, calls, and webhooks — the blast-radius control behind every automation feature.

Every change runs a ~1,400-test CI suite before deploy, including tenant-isolation tripwires, RLS-coverage guards, and permission-gate regression tests. API keys are stored as SHA-256 hashes; webhooks are HMAC-signed. Responses carry HSTS, frame, referrer and content-type protections plus a content security policy, and authentication endpoints are rate-limited per account and per network.