Responsible AI

Welcome to Aidge!

We believe responsible AI starts with a commitment to transparency, security, and respect for your data. Here, you’ll learn how our rigorous safeguards protect data security and system stability—delivering reliable support for your business. This page gives you access to trusted resources such as policies, audit reports, and real-time updates on our security controls.

Compliance

We align with globally recognized standards to ensure robust data protection and information security:

• ✅ Alibaba Cloud SOC 2 Type II Certified Our infrastructure runs on Alibaba Cloud, which has achieved SOC 2 Type II certification for security, availability, processing integrity, confidentiality, and privacy.

• 🛠️ ISO/IEC 27001 & 27701 (In Progress) We are actively pursuing ISO 27001 (Information Security Management) and ISO 27701 (Privacy Information Management) certifications. Audit completion is expected by Dec 2025, further validating our commitment to global best practices.

Security & Privacy Controls

Display 3–4 key controls on the homepage, with a link to 'View All Controls' for full details.

Our security program follows the control framework of ISO/IEC 27001 and ISO/IEC 27701. Key controls include:

Organizational Security

• Security policies reviewed annually The company’s core security and privacy policies are reviewed and updated at least annually to reflect changes in regulations, threats, and business operations.

• Background checks for employees and contractors Pre-employment background checks are conducted for all new hires and contractors with access to sensitive systems or data.

• Information security governance committee established A dedicated security governance committee meets regularly to oversee the information security program and review key risks and initiatives.

• Third-party risk management program in place All third parties with access to company systems or customer data undergo a risk-based security assessment prior to engagement.

• Incident response plan maintained and tested A formal incident response plan is documented, regularly updated, and tested annually through tabletop exercises.

• Secure onboarding and offboarding procedures Employees and contractors go through standardized onboarding and offboarding processes that include access provisioning and revocation.

• Acceptable use policy enforced All users must acknowledge and comply with the acceptable use policy governing the use of company IT resources.

• Remote work security controls implemented Secure remote access is provided via encrypted connections, multi-factor authentication, and endpoint protection requirements.

• Business continuity planning in place The company maintains a business continuity plan aligned with Industry Standard Principles, including regular impact assessments and recovery strategy reviews.

• Disaster recovery drills conducted Periodically Disaster recovery procedures are tested Periodically to ensure resilience against major disruptions.

---

Product Security

• Secure development lifecycle (SDLC) enforced A structured SDLC integrates security activities—including requirements, design review, testing, and release validation—into every stage of product development.

• Static and dynamic application security testing (SAST/DAST) used Automated SAST and DAST tools are integrated into CI/CD pipelines to detect code-level vulnerabilities pre-deployment.

• API security gateways implemented API traffic is routed through secure gateways that enforce authentication, rate limiting, request validation, and logging.

• Change management process enforced All production changes follow a formal change approval and review process to minimize unintended security impacts.

• Security requirements defined for vendors and integrations Third-party components and integrations must meet defined security standards before being incorporated into the product stack.

• Red team exercises conducted periodically Simulated adversarial attacks are carried out regularly to test detection and response capabilities across the product surface.

• User consent mechanisms for data processing Where applicable, users are presented with clear consent options for data collection and AI processing in accordance with privacy regulations.

---

Data Protection

• End-to-end encryption for high-sensitivity data Highly sensitive data, such as authentication credentials and personal identifiers, is encrypted both in transit and at rest using strong cryptographic standards.

• Access to personal data logged and audited All access to personal data is logged, monitored, and subject to periodic audit reviews to detect unauthorized activity.

• Right to erasure supported Processes are in place to honor user requests for data deletion in accordance with applicable privacy laws like GDPR and CCPA.

• Data breach notification procedure defined In the event of a personal data breach, the company will assess the risk and notify affected individuals and regulators within legally required timeframes.

• Data subject request (DSR) portal available Customers can submit data access, correction, and deletion requests through an open channel, processed within SLA timelines.

---

Application Security

• Multi-factor authentication (MFA) enforced for admin accounts Administrative access to production systems requires multi-factor authentication to reduce the risk of credential compromise.

• Input validation and output encoding enforced All user inputs are validated and sanitized to prevent common web vulnerabilities such as XSS and command injection.

• Error handling prevents information leakage Error messages are sanitized to avoid exposing system details, stack traces, or sensitive data to end users.

• Logging and monitoring centralized Security-relevant events are collected in a centralized SIEM system for real-time analysis, correlation, and long-term retention.

• Role-based access control (RBAC) granularity Permissions are assigned based on least privilege, with fine-grained roles defined according to job function.

• Audit trails maintained for critical actions Actions such as user provisioning, configuration changes, and data exports are logged with user identity, timestamp, and context.

• Brute-force attack protection implemented Login attempts are throttled and blocked after repeated failures to mitigate credential stuffing and brute-force attacks.

---

Risk Management

• Vendor risk reassessments conducted annually Third-party vendors with ongoing access to systems or data are reassessed annually for security posture and compliance.

• Insider threat program in development The company is building capabilities to detect and respond to potential insider threats through behavioral analytics and access monitoring.

• Regulatory compliance tracking system used A centralized system tracks evolving regulatory requirements across jurisdictions to ensure timely compliance.

• Risk register maintained and prioritized All identified information security risks are recorded in a central risk register and ranked by likelihood and impact.

• Security controls mapped to frameworks Controls are mapped to ISO 27001, ISO 27701, NIST, and other relevant standards to ensure comprehensive coverage and audit readiness.

• Executive-level risk reporting Senior leadership receives regular updates on top risks, control effectiveness, and emerging threats.

• Emerging threat intelligence monitored The company subscribes to threat intelligence feeds to stay informed about new vulnerabilities and attacker tactics.

Resources

For your compliance and audit needs, we provide:

Audit reports

• SOC 2 Reports (available upon request)

Policies

• Privacy policy

• Terms of Service

Contact

You can reach out to us by email: [email protected].

Subprocessors

We use trusted third parties to support our service. These subprocessors are carefully vetted for security and compliance.

Primary Infrastructure Provider:

• Alibaba Cloud – Our infrastructure is hosted on Alibaba Cloud. All production servers are located in Singapore (SG), ensuring low-latency performance and adherence to regional data residency requirements.