Security Built Into Every Layer
Asteria Engine is engineered with security as a foundational principle. Encryption, access controls, monitoring, backups, and incident-response processes help protect customer data.
Data Encryption
Practical encryption controls protecting your data in transit and at rest
Data in Transit
Customer traffic is protected with modern TLS encryption and strict transport controls for supported services.
Data at Rest
Sensitive platform data is encrypted at rest through managed cloud services and key-management controls.
Key Management
Key access is restricted to authorised systems and administrators, with logging and review for privileged operations.
Infrastructure Security
Hardened infrastructure with automated monitoring and rapid incident response
Container Security
Application workloads use isolated containerised services and controlled deployment pipelines.
Network Segmentation
Production and development environments are separated, with restricted access to internal services.
Automated Patching
Dependencies are monitored and patched through the release process according to severity and product risk.
Intrusion Detection
Application and infrastructure signals are monitored so suspicious activity can be investigated quickly.
Production Monitoring
Monitoring, alerting, and escalation processes support incident response for production systems.
Regular Audits
Regular internal security reviews with planned third-party assessments. Cadence and reports available on request.
Access Control & Authentication
Enterprise-grade identity and access management with comprehensive audit logging
Role-Based Access Control (RBAC)
Granular permission model with predefined roles (Admin, Manager, Editor, Viewer) and custom role creation for enterprise accounts.
Single Sign-On (SSO)
SSO options can be supported for enterprise customers that need centralised identity management.
Multi-Factor Authentication (MFA)
MFA support helps teams reduce account-takeover risk. Enforcement options depend on workspace plan and configuration.
Session Management
Configurable session timeouts, real-time session monitoring, and ability to revoke sessions instantly across all devices.
API Key Security
Secure API key generation with rotation policies. Keys are hashed and salted before storage. Leaked key detection enabled.
Comprehensive Audit Logs
Important account and workspace events are logged to support security reviews and troubleshooting.
Network Security
Enterprise-grade protection against modern threats at every layer
Web Application Firewall (WAF)
Perimeter protections help reduce common web attack and abuse patterns.
Controls are reviewed as the product surface and traffic patterns change.
DDoS Protection
Hosting and network providers include protections against common volumetric and application-layer abuse.
Provider-backed controls help protect availability during abnormal traffic spikes.
API Rate Limiting
Intelligent rate limiting per user, API key, and IP address. Prevents brute force and resource exhaustion attacks.
Configurable limits with whitelist/blacklist support for enterprise accounts.
VPN & Private Connectivity
Private connectivity options can be reviewed for enterprise customers with stricter network requirements.
Network requirements are scoped during procurement and onboarding.
Data Protection & Payment Handling
Current privacy commitments and payment-processing boundaries
GDPR Alignment
Built around UK GDPR and EU GDPR principles, including data-processing terms, subprocessors, data rights, and privacy controls.
CCPA Compliant
Privacy operations support access and deletion requests. Asteria Engine does not sell customer data.
UK Data Protection Act 2018
UK data protection requirements are reflected in privacy, DPA, retention, and data-rights processes.
PCI DSS Ready
Payment details are handled by PCI-compliant payment processors. Asteria Engine does not store full card details.
Vulnerability Management
Continuous scanning, rapid patching, and proactive threat research
Continuous Vulnerability Scanning
Dependencies, application code, and infrastructure are reviewed through automated checks and manual security review.
Patch Management
Security patches are prioritised by severity, exploitability, and customer impact, then released through tested deployment pipelines.
Dependency Management
All dependencies pinned to specific versions. Automated dependency updates tested in staging before production deployment.
Security Research
Security advisories, dependency updates, and relevant CVEs are reviewed as part of product operations.
Responsible Disclosure
Security reports sent to our team are triaged and handled through coordinated disclosure where appropriate.
Bug Bounty Program
Coordinated vulnerability disclosure program. Optional rewards assessed per case; details available on request.
Data Backup & Recovery
Multi-region redundancy with rapid recovery capabilities
Automated Daily Backups
Production data is backed up with encryption and retention controls appropriate to the service tier.
High Availability Design
Health checks and recovery runbooks support service resilience; specific SLAs are set during contracts.
Disaster Recovery Plan
Disaster recovery procedures are documented and reviewed, with recovery objectives agreed for enterprise deployments.
Data Residency Options
Data residency requirements can be reviewed during procurement for customers with strict localisation needs.
Third-Party Security
Rigorous vendor assessment and secure integration with trusted partners
Vendor Security Assessment
Critical third-party vendors are reviewed for security posture, data handling, and contractual controls.
Cloud Infrastructure
Cloud infrastructure uses managed security controls, access restrictions, logging, and review processes.
Payment Processing
Payments processed via Stripe, a PCI Level 1 compliant processor. No payment card data stored on our systems.
Analytics & Monitoring
Application and infrastructure monitoring supports operational health, alerting, and incident investigation.
Security Monitoring & Incident Response
Monitoring, alert routing, and coordinated response for production systems
Security Monitoring
Production systems emit security and reliability signals for review, escalation, and investigation.
Incident Response Team
Incident response processes cover triage, containment, remediation, customer communication, and post-incident review.
Security Event Logging
Relevant security events are logged with enough context to support investigation and compliance review.
Incident Communication
Affected customers are notified according to legal, contractual, and operational requirements.
Security Best Practices for Users
Simple steps you can take to protect your account and data
Enable Multi-Factor Authentication
Always enable MFA on your account. Use hardware security keys when possible for the strongest protection against account takeover.
Use Strong, Unique Passwords
Create unique passwords for your Asteria Engine account. Use a password manager like 1Password or Bitwarden to generate and store secure passwords.
Rotate API Keys Regularly
If you use API keys, rotate them every 90 days. Immediately regenerate keys if you suspect exposure or accidental disclosure.
Configure SSO for Teams
Enterprise accounts should implement SSO (SAML 2.0 or OIDC) for centralized authentication and easier user provisioning.
Review Access Regularly
Periodically audit team members' access levels. Remove access for departed employees immediately. Use audit logs to monitor changes.
Monitor Audit Logs
Regularly review audit logs in your workspace settings. Set up alerts for unusual activity or permission changes via our webhook integrations.
Use Approved OAuth Integrations
Only authorize official Asteria Engine integrations. Be cautious with third-party apps requesting access to your Asteria Engine workspace.
Report Suspicious Activity
If you notice unauthorized access or suspicious behavior, report it immediately to our security team at [email protected].
Responsible Disclosure
Discovered a security vulnerability? We're committed to addressing security issues responsibly. Please email our security team directly. We'll acknowledge your report within 24 hours and work with you on coordinated disclosure.
Email: [email protected]
Please do not publicly disclose the vulnerability until we have had time to address it and release a fix. We follow a 90-day coordinated disclosure policy.
Frequently Asked Questions
Questions about our security practices and certifications
Where is my data stored?
Customer data is stored with managed cloud providers under contractual controls. Data residency requirements can be reviewed for enterprise customers.
Can I use SSO?
Yes. Enterprise accounts get SAML 2.0 and OpenID Connect support. Contact sales to enable SSO with your identity provider such as Okta or Azure AD.
Do you share my data with third parties?
Asteria does not sell customer data. Data is shared only with service providers needed to operate the platform, such as AWS for hosting and Stripe for payments, under contractual controls.
What's your incident response SLA?
Security incidents are triaged through documented response processes. Notification timing depends on legal, contractual, and operational requirements.
How often do you run security audits?
Security reviews combine automated checks, internal review, and third-party assessment where required by customer or compliance needs.
How do I get a custom security audit package?
Enterprise customers can request custom security documentation, compliance reports, and attestations by emailing [email protected] with their requirements.
Need More Information?
Have specific security requirements or need custom documentation for your compliance team? Our security team is here to help.
Contact Security Team