Security

Authentication uses signed bearer tokens; passwords are stored only as bcrypt hashes and are never recoverable in plain text. New accounts require administrator approval before they can sign in, so access is granted rather than self-issued.

All traffic is served over HTTPS with certificates renewed automatically. The application database is managed, encrypted at rest, and reachable only over a private connection — it is not exposed to the public internet. Uploaded files are held in private cloud storage under the same access controls.

Public AI endpoints are rate-limited per client to prevent abuse. Cross-origin access is restricted to the platform's own front end. In production the interactive API explorer and machine-readable schema are disabled, so the endpoint surface is not published.

Application changes are version controlled and tested before release. Dependency and container findings are reviewed as part of maintenance, and database schema changes are applied through reversible migrations. Access logs and operational metrics support investigation without being copied into product analytics.

Suspected incidents are triaged for scope, containment, recovery and required notification. Restoration procedures rely on managed database and storage capabilities; recovery objectives and notification duties for an institutional deployment are agreed in its service terms.

AIC does not currently claim SOC 2 or ISO 27001 certification, nor a completed independent penetration test. These are assurance milestones, not controls we represent as already achieved. Prospective institutional customers may request the current architecture, control evidence and remediation plan under appropriate confidentiality terms.

If you believe you have found a security issue, email info.aic@hyrin.org with enough detail to reproduce it. Please do not disclose it publicly until it has been addressed. We will acknowledge and keep you informed of the outcome.