# Aevah Security and Governance

Public security and governance principles for evaluating Aevah.

Canonical page: https://www.aevah.com/security

## Security principles

Aevah applies enterprise controls to data access, AI reasoning, and workflow actions.

- Role-based access control and least-privilege policies
- Encryption in transit and at rest
- Audit trails for data access and AI actions
- Delegated user identity and permission enforcement for agent calls
- Classification and audit for every MCP tool call
- Versioned changes rather than destructive overwrite
- Data minimization, scoped sharing, and tenant isolation
- Lineage, explainability, policy enforcement, and change control

## Authentication and authorization

Authentication proves an identity. Authorization determines which tenant, data, tools, workflows, and actions that identity may access. Exact protocols, token lifetimes, scopes, and service-account policies are tenant-specific and confirmed during onboarding.

## Evidence and governance

Aevah maintains traceability from source data and definitions through decisions, recommendations, and actions so owners can review how an outcome was produced.

## Security review

Contact security@aevah.com for current control documentation and customer-specific requirements.

## Contact

- First Flight: https://www.aevah.com/how-aevah-works/start-small-and-expand
- Executive inquiries: mailto:executive@aevah.com
- Security inquiries: mailto:security@aevah.com