Compliance and Security Overview
This Trust Center provides transparent visibility into Aona AI's security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place.
SOC 2 Type 2
SOC 2 Type 1
GDPR
Third parties that process data on our behalf under strict contractual safeguards.
Comp AI
Compliance automation platform that hosts this Trust Center, processes access requests and NDA signatures, and stores Aona's compliance evidence.
Microsoft 365
Corporate productivity and identity. Microsoft Entra ID within this tenant is Aona's sole corporate identity provider for staff access to internal systems. Multi-factor authentication is required for all staff accounts, and legacy authentication protocols are blocked so that the requirement cannot be bypassed by clients unable to present a second factor. Microsoft 365 also provides staff email and document storage. It holds no customer product data.
Microsoft Azure
Cloud infrastructure provider. Azure hosts the Aona API, the customer and administration dashboards, and the regional edge services across all seven production regions: Australia, France, the United Kingdom, the United States, Singapore, Germany and Hong Kong. Each region is a separate Azure resource group with no cross-region links, so customer data remains in the region the customer selects. Azure is named as a subservice organisation in Aona's SOC 2 report under the carve-out method.
OpenAI
API provider for the large language model features in Aona's backend. Requests are processed in the United States. Under OpenAI's API terms, inputs and outputs are not used to train OpenAI models.
Resend
Transactional email delivery for Aona platform notifications such as account and alert emails.