Security
The security and safety of information within the platform is critical to our retailer and law enforcement users. We work hard to maintain a highly secure software platform that allows retail and law enforcement users to access information in a safe and responsible way.
Our commitment to security
We recognise that data protection, privacy, and security are high priorities for everyone in our community. We maintain industry-best practice controls for the security, availability, confidentiality and processing integrity of our platform. The guardrails we have built into our platform are designed to keep information safe.
Platform security at a glance
Auror is SOC 2 Type 2 compliant
Multi-factor authentication and SSO
End-to-end encryption and auditability
Best in class capability in security
Auror supports retailers to ensure the collection, storage, and use of information meets data and privacy compliance requirements.
Auror helps retailers comply with privacy legislation globally
- Data minimization
- Security, accountability and control
- Use and disclosure limitation
- Empowering individuals and enabling rights
Maintaining a secure and trusted platform
Encryption
We implement comprehensive data protection through multiple encryption protocols. All information in transit to and from our platform is secured using industry-standard encryption technologies, including TLS 1.2+ with robust cipher suites and 256-bit encryption. Our systems mandate secure communication channels enforced through enterprise-grade certificates with strong SHA-2 hashing algorithms.
Data protection extends beyond transmission security to include multi-layered encryption at rest across our distributed database infrastructure, utilizing key management systems for enhanced protection. At the application level, our development lifecycle integrates multiple security frameworks and testing methodologies to address common vulnerabilities such as SQL injection, cross-site scripting (XSS), and other OWASP-identified threats.
Our infrastructure is continuously monitored through a diverse array of intrusion detection and prevention systems. Multiple security vendors and technologies work in concert to provide real-time threat intelligence, behavioral analysis, and automated response capabilities across our server environments, network boundaries, and cloud resources.
User auditing
For user activity monitoring infrastructure, Auror employs multiple specialized tools to track, record, and audit all actions performed across our platforms. This multi-layered approach ensures complete visibility through integrated logging systems, user behavior analytics solutions, and change management frameworks - allowing for detailed forensic analysis and change reversibility when required.
In the event of suspicious activity, potential attack patterns, or policy violations, our security orchestration and response systems enable rapid identification of the responsible accounts.
Our identity management framework allows our security team to immediately deactivate access through various methods, preventing further unauthorized actions while preserving evidence for potential investigation.
Third party testing
Auror partners with independent third-party security specialists to conduct regular, comprehensive assessments validating the integrity of our security infrastructure.
Our robust testing framework encompasses network and application-level penetration testing performed through multiple approaches - including anonymous access attempts, authenticated testing using various credential sets, and advanced attack simulations.
These assessments leverage industry-leading vulnerability scanning tools, manual testing methodologies, and compliance verification frameworks to ensure our security controls meet rigorous standards across all deployed systems and platforms.
Detection and analysis
Our logging strategy incorporates multiple tools to consolidate and archive application, infrastructure, and security logs across diverse platforms for a minimum retention period of three years. Through a combination of sophisticated log analysis solutions, behavioral monitoring systems, and anomaly detection technologies, suspicious activities are identified and flagged in real-time. These security insights are immediately routed to our cross-functional engineering teams through various notification channels, enabling rapid investigation and response.
Vulnerability and threat management
Our comprehensive security approach leverages multiple industry-leading anti-malware solutions to protect cloud services and virtual machines. We employ a diverse security toolkit featuring intrusion detection systems, denial-of-service (DDoS) attack prevention mechanisms, regular penetration testing, advanced data analytics, and machine learning algorithms to continuously strengthen our defense posture and mitigate potential risks.
Automated vulnerability scanning tools systematically identify security weaknesses in our third-party libraries and frameworks. We maintain a robust patch management process, ensuring that security issues are remediated promptly when updates become available from any vendor.
Trusted partners
Microsoft and Google are trusted strategic partners in our security ecosystem, helping us protect and manage data in compliance with all applicable regulations. Our platform is hosted across cloud infrastructure provided by Microsoft Azure and Google Cloud Platform. Both providers operate world-class data centers with layered physical and digital protection, professional operations teams managing and monitoring environments around the clock, and continuously evolving defenses against emerging threats. Both maintain a consistent set of industry certifications including SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017 (cloud security), ISO 27018 (cloud privacy), and ISO 27701 (privacy information management).
Preguntas frecuentes
Preguntas frecuentes
Auror would review any government requests for data in accordance with applicable law and our terms of service. It’s important to note, Auror is typically a data processor, meaning retailers remain in control of their own data. Auror acts as their agent under their instruction.
Law enforcement users on the Auror platform can only access data that retailers have chosen to share with them.
Auror conducts annual penetration testing through independent third-party security specialists, covering application, API, mobile, and external network testing. Results are reviewed and findings are remediated on a risk-prioritized basis. Customers can request access to penetration testing reports subject to a signed NDA.
Auror does not share customer data with third parties. However, third-party vendors may be involved in storing or processing data as Auror's subprocessors — primarily Microsoft Azure and Google Cloud Platform.
Upon termination or expiry of an agreement, customers can request an extract of their data. Following that, Auror will delete all customer data and can provide a certificate of destruction upon request.
By default, different retailers cannot see each other's information entered into Auror. Access controls are enforced so that users can only access data belonging to their own organization. However, retailers can enter an agreement outside of Auror to share this type of information if they choose to.
Auror is SOC 2 Type 2 compliant. The platform is hosted on Microsoft Azure and Google Cloud Platform, which hold SOC 1/SSAE 16/ISAE 3402, SOC 2, and ISO 27001/27002/27018 certifications.
Auror has internal incident response processes in place to respond to and manage any data breaches. If incidents occur, the findings are used to improve processes and systems throughout the organization.
In the unlikely event of a data breach, Auror will promptly notify the affected customer(s) and any regulators, if required.
All user activities are monitored and can be audited meaning that any action performed by a user can be tracked (and changes reverted if needed). If there was misuse linked to a user, the user can be identified and deactivated.
Yes. Information is encrypted in transit and at rest. All data is encrypted and decrypted using 256-bit AES encryption. Data at rest is encrypted in SQL server using Transparent Data Encryption (TDE) that performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest. All information in transit to and from the Platform is encrypted using SSL 256-bit encryption and protected with Transport Layer Security (TLS/SSL).
Auror is fully hosted by Microsoft Azure and Google Cloud Platform in local regions. Each region utilizes a local instance to adhere to relevant security and privacy guidelines.