Aurian Trust Centre

Part 1: Security#

Every statement here must be true in production on the day it is published. Confirm each bracketed fact with the engineering lead and remove anything not yet live. This is the public summary; the contractual measures are Annex 1 of the Data Processing Addendum, and the internal Information Security Policy governs how we work.

The five things to know#

1. Your data is isolated at the database level. Every table that holds firm data is protected by row-level security that is enabled and forced, under an application role that cannot bypass it. A dedicated automated test suite checks that isolation on every code change and blocks release if it fails.
2. Nothing leaves without a person approving it. The Service drafts; your firm approves. There is no path from an incoming email to an outgoing quote that does not go through a human at your firm.
3. Your data is never used for another firm. Not to train models, not to tune prompts, not to inform another customer's Aurian. Our AI providers are contractually barred from training on it.
4. Hosted in the European Union (Ireland), encrypted in transit and at rest, backed up daily.
5. You can leave with everything. Full export at any time and for 60 days after you leave, then deletion.

Architecture#

Access#

• Portals without passwords. Clients, investors and buyers open portals through a unique link with an unguessable token. Nothing to phish, nothing to reuse. You can rotate or revoke any token at any time, and portal activity is logged.
• Roles inside your firm. Owner, admin, staff and guest roles limit what each person can see and do. Guests (consultants, contractors) see one project's stage and nothing else.
• Multi-factor authentication is on the roadmap for the first quarter of 2027 and will be required for owners and admins when released.
• Integrations by official authorisation only. Google, Microsoft, Xero, Slack and Telegram connect through OAuth or bot tokens with the minimum scopes. We hold no passwords for your other systems, and you can disconnect any of them in one click.

Operations#

• Least privilege for our own team. Production access is limited to named individuals, protected by multi-factor authentication on every provider account, reviewed quarterly and removed the day someone leaves. Privileged database access is separate from the application and used only for audited operations.
• Change control. Every change is reviewed before merge, passes automated tests including the isolation suite, and goes through a staging environment that holds no real customer data.
• Dependency and vulnerability scanning on every build. Security patches for critical vulnerabilities are applied within 7 days.
• Logging and monitoring. Server logs are kept for no longer than 90 days and audit logs for 12 months. Uptime and error monitoring with alerting to the on-call founder.
• Incident response. A documented procedure with severity levels and a named owner. Customers affected by a breach are told within 72 hours with what we know, and a written post-incident summary follows.
• Business continuity. Recovery point objective 24 hours; recovery time objective 8 hours. Backups are restored to test at least every six months.

Compliance and assurance#

• UK GDPR and the Data Protection Act 2018. Data Processing Addendum with every customer; ICO registration applied for, number to follow; sub-processor list published with 30 days notice of changes; international transfers under UK adequacy or the IDTA.
• Cyber Essentials certification is planned for the first quarter of 2027. ISO 27001 and SOC 2 are on the roadmap for 2028 as the business scales; we will share our current security documentation under NDA in the meantime.
• Penetration testing by an independent tester is planned for the first quarter of 2027; none has been completed yet. A summary will be available to customers on request.
• Vulnerability disclosure. Researchers can report issues under our Trust Centre (aurian.app/trust) at aurian.app/trust.

Your part#

Security is shared. Turn on multi-factor authentication for your team, remove leavers promptly, keep portal links with the people they are for, and review every draft before you approve it. Our Acceptable Use Policy sets out the rest.

Questions#

hello@aurian.app. A completed security questionnaire and a copy of our Information Security Policy summary are available to prospective customers on request.

Part 2: How we use AI#

This statement is informational. The binding terms are in the Customer Agreement (clauses 3.3 and 9) and the Data Processing Addendum. It is written to the UK government's AI principles (safety, transparency, fairness, accountability, contestability), the ICO's guidance on AI and data protection, and, for customers with EU clients, the transparency expectations of the EU AI Act for limited-risk systems.

1. What Aurian is, in one paragraph#

Aurian is a coordinator for design, construction and development firms. It uses AI to read what comes in (emails, web enquiries, voice notes, photographs, messages), to draft what should go out (replies, quotes, fee proposals, variations, progress updates, invoices, reminders), and to keep projects, diaries and money organised. A person at your firm approves everything before it leaves. That rule is built into the product and cannot be turned off.

2. Where AI is used#

3. What the AI does not do#

• It does not send anything, spend or commit money, raise an invoice, book a visit, or publish an update without a person at your firm approving it in the Service.
• It does not make decisions about individuals that have legal or similarly significant effects on them. Whether to take on a client, what to charge, or whether to accept a variation is always your decision.
• It does not learn from one firm and apply it to another. Your rate card, tone and corrections train your Aurian only.
• It does not give professional advice. Structural, planning, building-regulations, legal, tax and safety questions need a qualified person.
• It does not use your data to train the underlying AI models. Our providers are contractually barred from doing so.

4. Which models and providers#

We use third-party AI models through their business APIs: currently Anthropic (drafting, summarising and reading photographs) and OpenAI (voice transcription). They are listed in our sub-processor list in Annex 2 of the DPA with the region where they process data. We choose providers whose API terms exclude training on customer inputs and outputs, and we select the shortest data retention option they offer. We may change providers; customers receive 30 days notice under the Data Processing Addendum.

5. How we keep it accurate and fair#

• Grounding. Drafts are built from your own data: your rate card, past quotes, templates, calendar and project records. The AI is not asked to invent prices.
• Approve-as-is rate. We measure the share of drafts approved without edits, per firm, and investigate when it drops.
• Corrections become rules. When you correct a draft, the correction is stored as a rule for your firm and applied next time. You can see and change every rule.
• Testing. Prompt and model changes are tested against a fixed set of real-world examples before release, including examples designed to catch made-up figures, unfair assumptions and prompt injection through incoming emails.
• Prompt injection. Content that arrives from outside (an email, a web form, a photo caption) is treated as data, not as instructions, and the AI is instructed to ignore commands embedded in it. A person still reviews every draft.
• Bias. The Service does not use protected characteristics to price, prioritise or reply to enquiries, and we test for differences in how similar enquiries are treated.

6. Transparency to your clients#

Emails and portal messages that were drafted with AI assistance and approved by your firm are sent from your firm in your firm's name, because a person at your firm approved them. Your client portals carry a small line saying the portal is run by Aurian, which you can turn off. Where you are required by law or professional rules to tell clients that you use AI tools, that obligation is yours; we will give you the wording you need.

7. Your rights and how to challenge an output#

If a draft is wrong, correct it or discard it; that is what the approval step is for. If you think the Service has produced something unfair or harmful, or has behaved outside this statement, email hello@aurian.app. We will look into it, tell you what we found, and fix the cause. Individuals whose data is processed can exercise their rights under the Privacy and Cookies Notice, including the right not to be subject to a solely automated decision.

8. Changes#

We update this statement when we add an AI feature, change a provider, or change how a feature works in a way that matters to you, and we tell account holders by email.

Part 3: Who owns what#

This public policy explains, in plain English, the ownership positions set out in clauses 8, 9 and 10 of the Customer Agreement. If this page and the Customer Agreement differ, the Customer Agreement governs.

1. The rule in one line#

What you put in and what comes out is yours. The machine that turns one into the other is ours.

2. What you own#

Your inputs. Your rate card, supplier prices, margins, quote and fee templates, tone of voice, client list, projects, drawings, documents, photographs, voice notes, messages and everything else you enter or connect. Putting it into Aurian does not change who owns it.

Your outputs. Every draft, quote, fee proposal, invoice, schedule, report, transcript and message the Service generates for your firm belongs to your firm once generated. You can use it, edit it, send it and keep it after you leave, without any licence from us. The only qualification is that similar output may be generated for other firms from their own data; no firm owns the general patterns that produce output.

Your learned rules. What Aurian learns from your approvals and corrections (how you price, how you write, what you exclude) is part of your Customer Data. It is applied to your firm only and exported or deleted with the rest of your data when you leave.

Your brand. Your name, logo, colours and portal branding are yours. We use them only inside your tenant, on your portals, and in marketing you have agreed to in writing.

Your confidential information. Your prices, suppliers, clients, projects and processes are confidential to you. We do not show them to, or use them for, anyone else.

3. What we own#

The Service. The software, the agent designs, the prompts and workflows, the models and configurations we build, the interfaces, the documentation, the Aurian name and logo, and everything else that makes up the platform. Your subscription gives you the right to use it for your firm's internal business for as long as you subscribe. It does not give you any ownership in it, and you may not copy it, resell it, reverse engineer it, train a model on it, or build a competing product from it.

Aggregated statistics. Anonymised, aggregated numbers about how the Service is used across all customers (for example, average enquiry response time), which cannot identify any firm, client, price or person. We use these to improve the Service and to explain it to prospective customers.

Improvements to the platform. Where a feature was inspired by something a customer suggested, the feature belongs to us. The customer's own know-how that inspired it remains theirs.

4. Feedback and suggestions#

We build Aurian with our customers. When you suggest a feature or tell us how something should work, you give us permission to use that suggestion to improve the Service for everyone, without payment and without restriction. In return, Founding and Charter cohort customers have their suggestions reviewed first and, where we build them, built first, and we tell you when a feature you suggested ships. No customer receives exclusivity over a feature. Feedback never includes your Customer Data: your prices, templates and processes stay yours even where they inspired a feature.

5. Third-party and open source components#

The Service uses AI models from third-party providers under commercial API terms that prohibit them from training on your data, and open source software under its own licences, listed in our documentation. Nothing in your subscription restricts your rights under those open source licences, and nothing gives any third party rights in your data.

6. Copyright in AI-assisted output#

Under the law of England and Wales, copyright in a computer-generated work belongs to the person who made the arrangements for its creation. In Aurian, that is your firm: you supplied the data, configured the rules and approved the result. To put the matter beyond doubt, the Customer Agreement assigns to you any rights we might otherwise have in AI Output generated for you. Where output reproduces material that a third party owns (for example, a standard clause from a professional body's template you uploaded), that third party's rights are unaffected, and you are responsible for having the right to use what you upload.

7. When you leave#

You can export all of your Customer Data, including AI Output and learned rules, at any time and for 60 days after your subscription ends, in commonly used formats. After that we delete it. Nothing you created in Aurian is locked in.

8. Infringement#

If you believe content on aurian.app or in a portal infringes your rights, email hello@aurian.app with the details and we will investigate promptly. If a third party claims that your use of the Service infringes their rights, the Customer Agreement (clause 18.1) says what we will do about it.

Part 4: Reporting a security issue#

Follows the NCSC vulnerability disclosure toolkit and ISO 29147. Publish a security.txt file at aurian.app/.well-known/security.txt pointing to this page and to hello@aurian.app.

1. Our commitment#

In this policy, the Service means the Aurian software service, Customer Data and Business Day have the meaning given in the Aurian Customer Agreement, and we means Aurian AI Ltd.

We take security seriously and we value the people who help us find problems before anyone else does. If you find a vulnerability in Aurian, we want to hear about it, we will not take legal action against you for research that follows this policy, and we will fix what you find.

2. Scope#

In scope: aurian.app and its subdomains, the Aurian web application, client, investor and buyer portals, our public APIs and webhooks, and the integrations we operate with Google, Microsoft, Xero, Slack and Telegram.

Out of scope: the systems of our sub-processors and connected-service providers (report those to them); social engineering of our staff or customers; physical attacks; denial of service; spam; automated scanning that degrades the Service; findings that require a compromised customer account; and issues in third-party sites we link to.

3. What we ask of you#

• Test only against accounts and tenants you own or have explicit permission to use. Never access, modify or delete another customer's data. If you encounter someone else's data by accident, stop, do not save it, and tell us.
• Do not use techniques that could degrade the Service for others, and stop as soon as you have enough evidence to demonstrate the issue.
• Do not publicly disclose the issue until we have fixed it and agreed a disclosure date with you, or 90 days have passed since your report, whichever is sooner.
• Do not demand payment as a condition of reporting. We do not currently run a paid bug bounty, but we recognise good reports (section 6).
• Comply with the law. Acting within this policy is authorised access for the purposes of the Computer Misuse Act 1990, and we will not report you to law enforcement or pursue civil claims for research that stays within it. If a third party takes action against you for research within this policy, we will say publicly that you were authorised.

4. How to report#

Email hello@aurian.app with: a description of the issue and where it is; steps to reproduce, with screenshots or a proof of concept; the impact you believe it has; and how we can contact you. If the details are sensitive, email first and we will arrange a secure channel. You may report anonymously, but we cannot recognise you or keep you informed if you do.

5. What we will do#

6. Recognition#

With your permission we list researchers who have reported valid issues on this page. For significant findings we may offer a token of thanks at our discretion.

7. Changes#

We may update this policy at any time. The date at the top shows the current version.