Log in
trust · security

Security is the product.

Aleq's controls aren't a checklist bolted onto the product — they are the product. Connections start read-only, Aleq holds no payment authority, every action posts with a verified signature, and locked periods are sealed with a cryptographic digest. The control plane shows this live; this page is the formal disclosure.

Compliance

  • Security review — vendor security questionnaires, architecture notes, and relevant reports are available under NDA.
  • GDPR + CCPA — DPA available pre-sales. EU representative listed in DPA.
  • HIPAA — BAA available for healthcare customers. Aleq's per-tenant isolation supports HIPAA-grade obligations.
  • PCI-DSS — Aleq does not store cardholder data. Card data is tokenized at point of capture by our PCI-Level-1 payment processor.

Encryption

  • At rest — AES-256-GCM with per-tenant data encryption keys. Keys are managed in AWS KMS with HSM-backed master keys.
  • In transit — TLS 1.3 with forward secrecy. HSTS enabled with 2-year max-age.
  • Backups — encrypted with the same per-tenant keys. Retained 90 days.

Audit signatures

Every journal entry posted by Aleq is signed at the time of post with an ed25519 keypair held in HSM. Period closes are sealed with an aggregate signature over the entire period's signed entries. Auditors can verify cryptographically that no entries have been altered after signing.

Access controls

  • SSO — SAML 2.0 and OIDC supported (Okta, Azure AD, Google Workspace).
  • SCIM — automatic user provisioning and deprovisioning.
  • RBAC — granular, per-action permission model. Standard roles + custom role builder.
  • MFA — required for all human users on privileged actions. Hardware security keys supported.

Vulnerability disclosure

If you believe you've found a security vulnerability in Aleq, please email security@aleq.com. We acknowledge reports within 24 hours and aim to remediate critical issues within 14 days.

We operate a coordinated disclosure program. Eligible reports receive bounties from $500 to $25,000 based on severity and impact. Email security@aleq.com for scope and rules.

Incident response

Aleq runs continuous automated security monitoring with on-call response. In the event of a customer-impacting security incident:

  • Initial customer notification within 24 hours.
  • Status updates every 4 hours during the active phase.
  • Final post-incident report within 5 business days, including cause, scope, remediation, and prevention measures.

Penetration testing

Aleq commissions an annual external penetration test by an independent security firm. Customers can request the executive summary under NDA.