Organisation-scoped access
Authenticated requests are scoped to organisation membership and role. Sensitive administrative and governance actions apply additional role or ownership checks.
← Back to Aliena
Security & assurance
Security at Aliena
Aliena is designed for organisations that need controlled access, tenant isolation, traceable governance and defensible evidence. Security is treated as an operating requirement across the application, database and delivery pipeline.
SECURITY CONTROLS ACTIVE
RLSDATABASE ISOLATION
RBACROLE-BASED CONTROL
CISECURITY GATES
01
Access & data protection
Database Row-Level Security
Aliena uses Supabase Row-Level Security and organisation identifiers as part of its tenant-isolation model, reinforced by cross-organisation isolation checks in CI.
Governed approvals and audit history
Approval decisions, artefact state changes and other governed actions are designed to retain actor, state and decision history so important changes remain traceable.
Server-side privileged access
Service-role and privileged credentials are kept on trusted server paths and are subject to repository controls that prevent new unsafe privileged-client usage patterns.
02
Secure engineering
Production build and type safety
Pull requests run a production Next.js build and TypeScript checks so deployment-blocking build or type errors fail before release.
Secret and dependency scanning
Security CI includes secret scanning and dependency-risk governance to detect exposed credentials and high-risk dependency issues before merge.
Tenant-isolation tests
Automated security checks exercise cross-organisation RLS isolation, privileged scoping and schema-conformance controls against the governed data model.
Protected preview validation
Application changes are validated against the exact preview revision under test before Playwright is allowed to seed or exercise staging data.
03
Infrastructure & authentication
Supabase
Aliena uses Supabase for PostgreSQL, authentication and related platform services. Authentication/session handling is integrated server-side and organisation access is scoped in the application and database layers.
Vercel
The Next.js application is hosted on Vercel, with protected preview and production deployment workflows. Secrets used by the application are supplied through protected environment configuration rather than client-side source.
Authentication options
The platform supports authenticated user sessions and includes Microsoft/Entra integration paths alongside the core Supabase authentication flow. Optional MFA controls are supported for stronger account protection.
Encrypted transport
Public application traffic is served over HTTPS. Sensitive provider tokens and service credentials are handled on server-side paths rather than exposed to the browser application.
04
Assurance roadmap
SOC 2 Type IIPlanned
Formal SOC 2 Type II assurance is planned. Aliena is building the operating evidence, vendor controls and security processes required for that journey; this is not a claim of current certification.
ISO 27001In progress
ISMS documentation, risk management and supporting controls are being developed toward an ISO 27001-aligned operating model; Aliena is not currently claiming certification.
UK GDPRIn scope
Aliena operates from the UK and treats UK GDPR obligations, processor terms, data-subject rights and vendor DPAs as part of its privacy and security operating model.
05
Responsible disclosure
If you believe you have discovered a security vulnerability in Aliena, report it responsibly and avoid accessing data that does not belong to you.
Report tosecurity@aliena.co.uk
AcknowledgementWe aim to acknowledge credible reports promptly and keep the reporter informed while the issue is assessed.
IncludeA description, reproduction steps, affected area and potential impact where known.
Security claims are intentionally scoped. This page describes controls reflected in the current Aliena architecture and delivery process. Planned assurance work is labelled as planned or in progress rather than presented as certification.