Documents
Certificates and reports
Our latest independent certification, assurance, and security testing reports. Download what your review needs.
ISAE 3000 Type II report (SOC 2 equivalent)
Under NDAISAE 3402 Type II report (SOC 1 equivalent)
Under NDAContinuous security testing report
Under NDAReports marked Under NDA are shared under the non-disclosure agreement between your organization and Aibidia. Please keep them within your review team.
Compliance
Three frameworks, audited annually
Our ISMS follows ISO/IEC 27001:2022 and is evaluated against the ISO/IEC 27002 code of practice. More than 100 controls, selected from ISO 27002, ISAE 3000, ISAE 3402, and ISO 27017, are documented in a Statement of Applicability that covers the whole company.
Certification
ISO/IEC 27001:2022
An internationally recognized standard for how we manage information security across the organization.
Valid until 30 June 2028
SOC 2 equivalent
ISAE 3000 Type II
Independent assurance that our security controls are well designed and operated effectively over the full period.
Period Jul 2025 to Jun 2026
SOC 1 equivalent
ISAE 3402 Type II
Independent assurance over the controls relevant to your financial reporting.
Period Nov 2025 to Jun 2026
Our annual audit cycle
- 1 July
Audit period starts
Controls operate and are evidenced all year.
- Quarterly
Security management meetings
Every part of the organization takes part.
- March to July
External audits
KPMG tests our controls against each framework.
- Summer
New reports published
Added here as soon as we receive them.
Security controls
Security in every layer
Security isn't an add-on at Aibidia. It's built into how we design, build, and run the platform.
Infrastructure
- Built on Microsoft Azure PaaS and managed services for scale and resilience
- Each customer gets an isolated Azure SQL database and blob container
- Customer data only in production and user acceptance testing environments
Encryption
- TLS 1.2 or higher for all data in transit
- Transparent Data Encryption and AES-256 for data at rest
- Backups encrypted with AES-256
- Keys managed in Azure Key Vault with access control and audit logs
Identity and access
- Single sign-on with Microsoft Entra ID or Google Identity
- Multi-factor authentication required
- Role-based, need-to-know access, reviewed yearly with segregation of duties
- Staff access to customer data only with client approval, logged and monitored
Secure development
- Follows the Microsoft Security Development Lifecycle
- Separate environments and mandatory code review
- CI/CD quality gates: unit, end-to-end, functional, and acceptance testing
- Vulnerability checks before release
0
Critical, high, or medium findings
Independent specialists test the platform continuously. Their March 2026 report rates the application's security level as good. Microsoft Defender for Cloud scans alongside, with a 48-hour target for high-severity patches.
AI and your data
AI that follows your rules
TP Intelligence and TP Aurora run inside the same security framework as the rest of the Aibidia platform.
01
No training on your data
Customer data is never used to train or fine-tune AI models. AI runs in inference-only mode.
02
Your permissions apply
Data isolation, role-based access, and least-privilege controls mean AI only retrieves data the user can already see.
03
Governed by our ISMS
AI use sits within our ISO 27001 certified, SOC 2 assured framework, with oversight from Engineering and Legal.
04
Model agnostic
If your policy blocks a specific AI provider or region, we can substitute another model.
Working within your AI policy
We start by understanding your restrictions, and bring our Security, Legal, and Product teams into the review. We never ask you to bypass a policy or bring AI into production workflows before it's approved, and you can keep using Aibidia's existing structured workflows while your assessment runs.
Data and resilience
Your data stays in the EU
We maintain a formal Disaster Recovery Plan and Business Continuity Plan as part of our ISO 27001 program, and test them at least once a year.
Where your data lives
Primary storage in Ireland. Backups in the Netherlands, which you can switch off on request.
Primary data zoneCan be disabled on request
Backup and recovery
Encrypted backups run continuously, with recovery targets built into our continuity plans.
<12 h
Recovery Time Objective
10 min
Recovery Point Objective
- Incremental backupsKept 14 days
- Weekly backupsKept 2 months
- Monthly backupsKept 6 months
- Yearly backupsKept 3 years
Privacy
Minimal personal data, by design
Aibidia processes personal data in accordance with applicable legislation, including the General Data Protection Regulation (GDPR) of the EU and the UK General Data Protection Regulation (UK GDPR).
The personal data processed as part of Aibidia's service provision is only the user credentials and related data of the users of the service, to enable them to use the service. This is a limited amount of personal data that contains no sensitive information.
Aibidia enters into personal data processing agreements with its customers and processes personal data in accordance with the agreement and legislative requirements.
Data Processing Agreement
Our standard DPA is part of the Order letter and covers processing scope, breach handling, personal data audits, and deletion at contract end.
Privacy policy
How we handle personal data across Aibidia. Read the privacy policy
Governance
Security is owned at every level
Accountability
- CEOUltimately accountable for security in corporate governance and business continuity.
- Executive Management TeamKeeps security aligned with company strategy.
- Information Security Management TeamDrives awareness and compliance with our policies.
- Security Operations Control teamGrants platform access and holds privileged infrastructure rights.
- Every employeeSecurity is everyone's responsibility.
Risk management
We grade each risk on likelihood and impact using an asset, threat, and vulnerability model. Risks are reviewed periodically, new risks are identified every year, and results go to the Information Security Management Team.
Third-party management
Every vendor involved in delivering our service is managed within our ISMS. They must meet our security requirements (ISO 27001 and SOC as standard, an NDA at minimum), pass a risk assessment with audit rights, and are reviewed every quarter.
“Information security is central to the preservation and assurance of this trust. The confidentiality, integrity and availability of information, in all its forms, are critical to the on-going functioning and good governance of Aibidia.”Aibidia Information Security Policy
FAQ
Frequently asked questions
The questions we hear most in security and due diligence reviews.
Certifications and audits
What certifications and reports does Aibidia have?
Aibidia is ISO/IEC 27001:2022 certified and has ISAE 3000 Type II (SOC 2 equivalent) and ISAE 3402 Type II (SOC 1 equivalent) assurance reports. You can download all of them from the documents section.
How often are you audited?
Every year. KPMG audits our controls against ISO 27001, ISAE 3000, and ISAE 3402. Our audit period runs from 1 July to 30 June, with external audits between March and July. New certificates and reports are published here once we receive them.
Can we share the ISAE reports inside our organization?
Yes, with the people involved in your security and vendor review. The ISAE reports and the security testing report are confidential and shared under the NDA between your organization and Aibidia, so please don't pass them on to anyone outside it. The ISO 27001 certificate can be shared freely.
Do you perform penetration testing?
Yes. Independent third-party specialists test the platform continuously. Our March 2026 report found no critical, high, or medium risk findings, and it's available in the documents section.
Data protection
Where is my data stored?
Customer data is stored in Microsoft Azure's North Europe region (Ireland). Geo-redundant backups are stored in West Europe (the Netherlands), and you can ask us to disable them so no data leaves the Ireland data zone.
Is my data kept separate from other customers' data?
Yes. Each customer environment has its own isolated Azure SQL database and blob container. Customer data resides only in production and user acceptance testing environments.
How is my data encrypted?
All customer data is encrypted in transit and at rest. Data in transit uses TLS 1.2 or higher. Data at rest, including databases and blobs, uses Transparent Data Encryption (TDE) and AES-256. Backups are also encrypted with AES-256.
What are your disaster recovery and backup targets?
We maintain a formal Disaster Recovery Plan and Business Continuity Plan as part of ISO 27001, tested at least annually. Our Recovery Time Objective is less than 12 hours and our Recovery Point Objective is 10 minutes, supported by incremental backups plus weekly, monthly, and yearly backups.
How quickly do you fix vulnerabilities?
Microsoft Defender for Cloud scans our environment automatically, and we aim to patch high-severity issues within 48 hours. Findings from our continuous security testing are tracked and remediated through our regular development cycle.
Access and identity
Who has access to my data?
Access follows the principle of least privilege. Aibidia staff access customer data only after client approval, and only a small group of infrastructure administrators can be granted it. All access is logged and monitored.
Do you support single sign-on (SSO)?
Yes. The Aibidia platform supports single sign-on through OAuth 2.0 with Microsoft Entra ID (formerly Azure AD) or Google Identity.
Is multi-factor authentication required?
Yes. Multi-factor authentication is required, and with single sign-on Aibidia never receives your users' passwords.
AI
Is my data used to train AI models?
No. Customer data is never used to train or fine-tune AI models. AI features run in inference-only mode and only retrieve data the user is already authorized to access.
Our policy restricts the use of AI. Can we still use Aibidia?
Yes. We start by understanding your restrictions and involve our Security, Legal, and Product teams in the review. We never ask you to bypass a policy, and you can keep using Aibidia's existing structured workflows while your assessment is completed. If a specific AI provider or region is blocked, we can substitute another model.
Contracts and reviews
Do you provide a Data Processing Agreement (DPA)?
Yes. Aibidia's standard Data Processing Agreement is incorporated into our Order letter. It outlines the roles and responsibilities of Aibidia as processor and the customer as controller, and among other things, covers data processing scope, data breach handling, personal data audits, and data retention and deletion upon contract termination.
Will you complete our security questionnaire?
Yes. Our Information Security Management Team supports security and IT review questionnaires as part of your due diligence. Send yours to your Aibidia contact, and share this page with your reviewers first, since it answers many common questions.
No questions match your search. Try a different word, or ask your Aibidia contact.