Security at ilion

Every organization’s data is isolated by organization ID at the database layer (PostgreSQL row-level security) and again in the application layer. Isolation is enforced by automated tests in CI, including cross-tenant red-team tests, on every change.

All traffic is encrypted in transit (TLS 1.2+). Data is encrypted at rest by our database and storage provider (AES-256).

Primary data storage runs in the EU (AWS eu-west-1, Ireland) and application functions are pinned to the EU (Dublin). See the subprocessor list for where each optional integration processes data.

AI agents propose; humans approve. Changes agents suggest go through an approval queue, and no outbound communication is ever sent without an explicit human action. Model providers are contractually barred from training on your data.

Operational logs are automatically minimized on a schedule: AI-run inputs and outputs are redacted of personal data after 90 days, error logs are deleted after 90 days, and audit trails are kept 2 years for accountability. Windows are configurable for enterprise agreements.

Record-level change history captures who changed what and when — humans, agents, and API alike. Vendor administrative access to a customer organization requires a stated reason and is itself logged.

Role-based access within each organization (owner / admin / member) gates organization-wide settings, secrets, and member management. Accounts are provisioned by invitation; passwords require 12+ characters and are checked against known-breach lists.

Administrators can export the organization’s complete data as structured JSON at any time — every record, no ticket required. Easy exit is part of the trust model.

A platform-wide and per-organization kill-switch can instantly halt all outbound email, calls, and webhooks — the blast-radius control behind every automation feature.

Every change runs a ~1,400-test CI suite before deploy, including tenant-isolation tripwires, RLS-coverage guards, and permission-gate regression tests. API keys are stored as SHA-256 hashes; webhooks are HMAC-signed.