Security & your data
Written for the security and data protection teams who have to sign off a new supplier. Every statement on this page describes how the platform works today.
Where it lives
The platform runs on a host you provide, and your data stays there. What leaves it is the alert notifications sent through the channels you enable, and support access as described below. You are the controller; we act as processor only when we access it for support, under a data processing agreement (GDPR art. 28).
Hosted in the European Union. We are processor, always under a data processing agreement (GDPR art. 28).
How it is built
Every function goes through an authenticated API, the same one the interface uses. Direct database access is limited to read-only diagnostics by the support team.
Each role sees and does what it needs, and no more. Two-factor sign-in is available.
Each installation has its own keys and passwords, generated on its own host and never borrowed from another site. Equipment credentials are stored encrypted.
Every planned change carries who authorised it, and is checked afterwards against what the equipment actually shows.
Personal data
Analytics are built to answer questions about a space or a service, not about a person. Visitor Wi-Fi analytics, for example, keep no device address, and dashboards and metrics never carry an identifier.
Clinical records, such as treatment histories in a clinic, are a special category of personal data (GDPR art. 9), handled with their own retention and access rules.
AI and your data
Nothing in the platform calls an external AI service. The support team does work with AI assistants: when it investigates an issue on your installation, it does so with read-only access, under the data processing agreement, and with the AI provider named as a subprocessor. If your policy rules that out, say so, and support on your installation is done without it.
Aligned, not certified
Controls are aligned with ISO 27001 and NIST CSF. We are not certified, and we say so. A security questionnaire is available on request at hello@airfexlabs.com. To report a vulnerability, see how to report it.
Vulnerability disclosure
Write to security@airfexlabs.com with the product and version, the steps to reproduce it and its impact.
AirFexLABS platforms in their supported versions, the installations we host in the EU, and airfexlabs.com. Systems owned by our clients or partners are out of scope: testing a client's installation needs that client's written permission. No denial of service, social engineering or physical testing.
We acknowledge your report within 3 business days, give a first assessment within 10, and update you at least every 14 days.
Critical issues within 30 days, high within 60, the rest within 90.
90 days by default, longer by agreement. A vulnerability that is being actively exploited is reported to the authorities as the law requires, without waiting.
A public advisory and a CVE once the fix ships, crediting you if you wish. We do not pay rewards.
We will not take action against research done in good faith within this policy. We cannot authorise access to systems that are not ours, and this policy does not override the law.