Platform and data security

🚧
Work in progress - not complete documentation
This section is being created. Contact Aera for full overview.

All Aera products, in store and online, run on the same platform. This is how Aera protects it and your data.

Infrastructure

Aera runs on Amazon Web Services (AWS) data centres, and follows AWS best practices.
There are several layers of infrastructure security, and access is role-based.

Where the data is	How it is protected
Stored	Encrypted with strong encryption, in managed databases that are patched regularly. Stored at least twice, with at least 25 days of backups, and reachable only inside Aera's private cloud.
On its way to and from Aera	TLS 1.2 or newer on every request. Aera signs every API response, so you can check that it comes from Aera and hasn't been changed.
Being processed	Every request needs an API key, and most need an access token. You only get the data your agreement gives you access to. Every request is validated, and anything unexpected is rejected.

API protection, firewalls and protection against denial-of-service attacks, plus capacity that scales automatically
Activity across the platform is logged and monitored for anything unusual
Aera's code is checked by automated security tools and reviewed by other developers, and the platform is audited regularly

How to authenticate, check signatures and handle errors: Authentication and Signatures and security.