Security & Compliance.

Our approach

We operate our own multi-tenant products in production under the same controls we build into client work. Architectural decisions are recorded and reviewed, and security is a design input from day one rather than a later retrofit.

Tenant isolation & access control

• Multi-tenant data isolation. Tenant data is separated at the database layer with PostgreSQL row-level security, enforced through a single scoped access path so one tenant cannot read another’s data.
• Role-based access control. Staff access is scoped per account with role-based permissions, following least privilege.
• Authentication. Staff sign in with a password they set or with their Google account (SSO); access to operational tooling requires an authenticated, per-account session.

What our systems record

We do not run a general-purpose audit log today, so we won’t describe one. What our products record is narrower, and worth stating precisely:

• Actor attribution on records. Records carry the staff account that created or last changed them, stamped server-side from the authenticated session rather than supplied by the client.
• Overrides are recorded, never silent. Where staff can override a system guard — booking past stated capacity, for example — the override is stored on the record it applies to.
• Per-customer activity timeline. A customer record shows its booking lifecycle and staff notes in order, so front-desk history is readable in the console.
• Durable event stream. Domain events are written in the same database transaction as the change that produced them and dispatched from there, so a delivery failure cannot lose an event that already happened.

A tenant-scoped, operator-readable audit log — every consequential action, queryable, with a stated retention window — is on our roadmap and not in production. If your engagement needs one, raise it early and we will scope it as work rather than assume it already exists.

Data protection

• In transit. Traffic is served over TLS.
• At rest. Data is stored on managed AWS services with encryption at rest.
• Sensitive artifacts. Files such as payment receipts are kept in private storage (Amazon S3), not publicly accessible.

Payments

Card and wallet payments are processed by Maya, a PCI-DSS-compliant payments provider. Card details are entered on Maya’s own pages and handled by Maya — they are not stored on our systems.

Privacy & data-protection law

We handle personal data in line with the Philippine Data Privacy Act (RA 10173) and apply GDPR/UK-GDPR-aligned practices for visitors and clients in the EU/UK; comparable care applies for Canada (PIPEDA), Australia and New Zealand (APPs / Privacy Act). A data-processing addendum and standard contractual clauses can be provided for client engagements on request. See our Privacy Policy.

Accessibility

We target WCAG 2.1 AA across our products and this site — see our Accessibility statement.

Certifications

Auxelit is not currently SOC 2 or ISO 27001 certified. We build and operate to those control frameworks, pursue formal certification when an engagement requires it, and are glad to complete vendor security questionnaires and walk you through our current practices on request. We will only display a certification here once it has actually been issued.

Reporting a vulnerability

Found a security issue? Please email support@auxelit.com with the details and steps to reproduce. We’ll acknowledge your report and keep you updated. Please give us a reasonable chance to remediate before any public disclosure.

Contact

Security or compliance questions? Email support@auxelit.com.