Compliance
Honest inventory: no third-party certification (SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP) has yet been undertaken. Customizable GDPR DPA available today, audit logs exportable to your SIEM.
Trust Center at a glance
No third-party certification (SOC 2 Type II, ISO 27001, HIPAA BAA, PCI DSS SAQ-D, etc.) has yet been undertaken to date — see the standard by standard details below. The GDPR DPA can be signed today, customizable on Enterprise. For a precise inventory and your compliance requirements, write to our team.
An urgent security question? security@aurabase.cloud (response within 48 working hours). Disclosure vulnerability: bug bounty program active on huntr.dev/aurabase.
Inventory of 8 standards
| Standard | Status | Details |
|---|---|---|
| SOC 2 Type II | Not committed | No third-party audits in progress to date |
| ISO 27001 | Not committed | No certification in progress to date |
| GDPR · DPA | Available | Standard Signable DPA, Customizable Enterprise |
| HIPAA BAA | Not committed | No standard BAA available to date |
| PCI DSS SAQ-D | Not committed | No certification in progress to date |
| FedRAMP Moderate | Not committed | No audits planned to date |
| SecNumCloud | Not committed | No ANSSI process in progress to date |
| C5 Germany | Not committed | No BSI process in progress to date |
Your data stays in your region
When creating the project, you choose a region. Primary data, backups, replicas and CDN caches remain physically in this region. Changing region involves assisted migration.
- Free / Pro: choice from 12 regions (EU, US, APAC, LATAM)
- Enterprise: pinning by country, contractual commitment
- Enterprise + dedicated FR cluster: data residency France, SecNumCloud approach not initiated to date
- Dedicated Private VPC (Isolated): complete network isolation, zero traffic outgoing from the VPC
Aurabase telemetry logs (aggregated metrics, anonymized system errors) are stored US by default. Option Enterprise to keep them in your region.
Contractual transparency
Our GDPR DPA (Data Processing Agreement) can be signed electronically from the Studio in 1 click on the Pro plan, customizable on Enterprise. The complete list of our subcontractors is published on /dpa.
Scaleway SAS
Kapsule K8s, PostgreSQL HA, S3, Redis
France (fr-par-1/2/3)
Hetzner Online
Secondary Compute & Edge WASM
Germany (fsn1, nbg1)
Mollie B.V.
EU Sovereign Payments & Subscriptions (CB / SEPA)
Netherlands (Amsterdam, EU)
Twilio Ireland
Authentication SMS
Ireland (EU)
Complete trace, SIEM export
Each auth, sensitive data access, policy change event is logged. Retention 30 days (Pro), 2 years (Enterprise). Export via webhook to your SIEM (Splunk, Datadog, Elastic) or dedicated Kafka stream.
RTO 15 min, post-mortem 5 days
Severity 1 (prod down): Slack + PagerDuty notification within 15 min, bridge call operated until resolution. Public post-mortem within 5 working days, shared action plan. RTO 4h, RPO 15 min for the Enterprise plan.
Real-time status on status.aurabase.cloud — 90-day history, subscription by email/webhook/RSS.