For an overview of how Aire agents protect customer data, see Security at Aire. This notice sets out the scope of those statements.
1. Customer agent deployments
Each Aire agent deployment is hosted by AirSend or deployed in the customer's own cloud account. The security controls for a deployment, including single sign-on, role-based permissions, data retention periods, audit log export and data handling, are agreed with the customer and set out in writing before the agent goes live.
Customer documents and case data are not used to train AI models. AirSend personnel do not read customers' end-customer information. Customer approval, rejection and escalation decisions are made by the customer's named reviewers.
2. KYB documents agent
The KYB documents agent at playground.aireone.io is available to try with a Google account or a one-time email code. Sessions expire after 24 hours, and each account can access only its own cases.
Uploaded documents are stored privately and uploaded through short-lived, authenticated links. Uploads are size-limited and validated before processing. Documents are processed by our AI model provider to extract information, and cases and their documents are deleted automatically 24 hours after creation. Upload only documents you are authorised to share.
3. Website
AirSend operates the Aire marketing website. It is served over HTTPS and hosted on Vercel. Do not send credentials, identity documents or confidential customer files through the website enquiry form.
4. Certifications and security reviews
Aire does not currently hold SOC 2 or ISO 27001 certification. We complete customer security questionnaires and vendor reviews, and agree availability, backup, incident-response and data residency requirements in writing for each deployment.
5. Report a concern
Send security questions or vulnerability reports to henry@aireone.io. Include enough information to explain the concern without exposing sensitive data. Contact us for an appropriate sharing method if sensitive evidence is necessary.
Reporting a vulnerability does not authorise accessing data or disrupting our services. We do not promise a fixed response time. Applicable incident assessment and notification duties remain governed by law.