Security
Security at Aria
Aria works with your project, client and financial data, so the controls around it have to be checkable rather than reassuring. This page is maintained by the Aria team and sets out what has been independently assessed, and what we do ourselves.
Independently assessed under Google's CASA Tier 2 programme
Aria has been assessed by an independent laboratory Google trusts, against the OWASP Application Security Verification Standard, under Google's Cloud Application Security Assessment (CASA) programme at Tier 2. The assessment is passed and is renewable annually.
The controls behind the assessment
Aria can interpret and propose changes to live business records. These are the constraints that keep that access bounded, and each one is enforced in the product rather than in policy.
Row-level security on every table
Access is deny-by-default and enforced in the database, on every table in the application schema — over 170 of them. Aria queries your data as you, scoped to your workspace and your permissions. An agent never gets free access to everything.
Financial maths is computed, not generated
Margins, budget burn, forecasts and invoice totals are calculated server-side from your records. The model reads the result; it cannot invent a number.
Only what an AI task needs
Aria sends the information required for an enabled AI task through authorised processing services. We apply permissions, minimisation and redaction controls where appropriate, but some user-entered text and relevant project information may need to be processed to provide the feature. Document content is treated as untrusted input rather than as instructions. Your client data is never used to train models.
Output verified against your records
What Aria extracts or asserts is checked back against the underlying records before it reaches you, with evidence attached. Where confidence is low, Aria says so instead of guessing.
An audit trail on every approved action
Anything Aria does after your approval is recorded — what changed, on whose authority, and when. Each action can be traced and, where the underlying workflow allows it, reversed.
Infrastructure and access
Aria runs on managed Postgres infrastructure hosted on AWS. Data is encrypted at rest with AES-256 and in transit with TLS. Sign-in is via Google OAuth or email and password, with multi-factor authentication available through Google.
Questions, or reporting an issue?
For security questionnaires, data processing terms, or to report a suspected vulnerability, contact us directly. We respond to security reports before anything else.