Not because we promise it — because we can't. Our AI client is retired and throws on any call. Every answer the product gives is produced by deterministic code, never a live model. You don't have to trust us — you can verify it yourself.
Your compliance data never reaches a third-party AI model. Not because we promise it — because we cannot: our LLM client is retired and throws on any call. Every answer the product gives is produced by deterministic code, templates, or pre-computed data, never a live model call.
What makes it true
src/lib/ai/anthropic-client.ts is a retired stub: callAI, callAIBatch, checkSpendCap and logCost all throw immediately. No customer-facing code path performs an LLM API call (HARD RULE #3). Any accidental re-import surfaces as a build-time or runtime error rather than a silent cost/leak.
How to verify it yourself
Read src/lib/ai/anthropic-client.ts — every exported function throws. Grep the codebase for live Anthropic/OpenAI SDK calls in customer paths: there are none. The determinism is enforced in code, not in marketing copy.
The exact file that enforces it
src/lib/ai/anthropic-client.tsPaste a report hash from any Aegis Firma compliance report to verify its cryptographic signature in real time.
The hash can be found in the footer of any Aegis Firma compliance report PDF. Format: 64-character hex string.
EU-region infrastructure
All data is stored in EU-region data centres (eu-central-1). Personal data never leaves the EU. We do not use US-region processing for EU customer data.
Encryption everywhere
Data encrypted at rest (AES-256) and in transit (TLS 1.3+). Database backups are encrypted. Keys are managed separately from data.
Ed25519 cryptographic audit trail
Every compliance report is signed with an Ed25519 key. The signature is appended to the document hash. Anyone can independently verify that a report has not been tampered with.
SHA-256 document integrity
Every document stored in Aegis Firma has a SHA-256 hash computed at upload. Any modification to the file — even a single byte — produces a different hash, making tampering detectable.
Zero data selling
We do not sell, rent, or share your data with third parties for advertising or analytics. Your compliance data is never used to train AI models.
Immutable audit log
All compliance actions (document creation, signature, status changes) are appended to a cryptographically-chained audit log. Once per day every signed record is anchored into a Merkle root, chained to the previous day — so no entry can be back-dated or retroactively edited without a detectable break.
| Layer | Details |
|---|---|
| Application | Next.js 14 App Router on edge runtime |
| API | Server-side routes with Supabase RLS enforcement |
| Database | PostgreSQL with Row Level Security (RLS) on all tables |
| Storage | Supabase Storage — per-org bucket isolation |
| Crypto | Ed25519 signatures via Node.js crypto (PKCS8/SPKI DER) |
| Auth | Supabase Auth — JWT, email+password, optional SSO (OIDC/SAML) |
| Region | EU-central (Frankfurt) — no data leaves the EU |
| Transactional email via Resend (EU endpoint) |
Document hash
When a compliance report is created or updated, Aegis Firma computes a SHA-256 hash of the document contents. This hash changes if even a single character in the document is modified.
Canonical audit payload
A canonical JSON payload is constructed containing the document hash, event type, timestamp, and user identity. The payload is sorted by key to ensure deterministic serialisation.
Ed25519 signature
The payload is signed using an Ed25519 private key stored in a secured environment variable, never persisted to the database. The resulting signature is a 64-byte value.
Signature stored with report
The hex-encoded signature and the public key are stored alongside the audit trail entry. The public key allows anyone to verify the signature independently.
Verification
To verify: reconstruct the canonical payload from the stored fields, then verify the stored signature against the stored public key. If the payload or signature has been tampered with, verification fails.
Found a security issue? We take vulnerability reports seriously and will respond within 48 hours.
Report to: security@aegisfirma.com
We do not currently offer a bug bounty programme. All valid reports will be acknowledged and credited.