Security

In place today

• Tenant isolation enforced by the database. Row-level security scopes every record to your organisation, and a database trigger prevents accounts moving between organisations or escalating their own role. This design still needs production-state and independent cross-tenant verification before a real-data pilot.
• Encryption everywhere. TLS in transit; encryption at rest on our cloud database and file storage.
• Private file storage, time-limited links. Documents live in a private bucket with organisation-scoped paths. There are no public file URLs anywhere in the product; where a link must be minted (the document editor), it is signed server-side and expires within 30 minutes.
• Secrets stay server-side. AI-provider and email keys are held as server-side secrets and are never present in the browser. All AI traffic goes through our own server-side proxy.
• Versioning that never overwrites. Every document change creates a new version requiring approval; originals and superseded versions are archived, not replaced.
• Database-attested mutation audit. Record mutations create a server-timed event tied to the authenticated user in the same transaction. Rich client events remain contextual and are not described as a complete security or provider-call ledger.
• Sessions and administrator assurance. Sign-in sessions are per-tab and cleared when the tab closes. Full Admin server capabilities require an AAL2 session; recovery and enrolment must be rehearsed before pilot onboarding.
• No behavioural analytics or replay. Sentry receives scrubbed diagnostic error events; session replay and performance tracing are disabled.

Committed and in progress

• Production verification — four-principal REST/RPC/Storage tests covering anonymous, staff, same-organisation admin and other-organisation admin.
• Tamper-evident, exportable audit trail — immutable database rows are in place; signed exports and provider-call completeness remain to be delivered.
• Managed malware scanning — current controls reject unexpected formats, macros, embedded objects and active PDFs, but are not a substitute for antivirus.
• Independent penetration test — commissioned after the hardening work above lands, before any paid NHS customer. Executive summaries will be available in the evidence room.
• Cyber Essentials — self-assessment first, Cyber Essentials Plus as the target.

Reporting a vulnerability

If you believe you've found a security issue, email hello@ayrisiq.co.uk with "SECURITY" in the subject line. We acknowledge within one working day, and we will never take action against good-faith research.