This page describes the administrative, technical, and physical safeguards that Aurora Digital Solutions Inc., operating as Aurora Designs ("Aurora"), applies to client data. It is provided for information, for clients and prospective clients conducting vendor and security reviews. Aurora's contractual commitments are set out in its Data Processing Addendum ("DPA"), and its service providers are listed on the Sub-processors page.
1. Data storage
Client data held by Aurora is stored primarily on an encrypted volume on Aurora-owned and Aurora-managed hardware.
Depending on the engagement, client data may also be held in:
- other encrypted storage controlled by Aurora
- Aurora's Google Workspace environment, including email and Google Drive
- private GitHub repositories, which contain primarily source code and configuration but may contain limited client data where a build requires it
- the other services listed on the Sub-processors page, including legacy content in Notion
Aurora's practice is not to commit credentials, API keys, or other secrets to source-code repositories, and not to store client data in folders that synchronize to consumer cloud services.
2. Access control
- Access to client data is limited to Aurora personnel and subcontractors who require it to perform the services
- Personnel and subcontractors with access are bound by written confidentiality obligations
- Two-factor authentication is enabled on accounts used to access client data, where the service supports it
- Credentials are issued to individuals and are not shared
- Access is revoked when an individual no longer requires it
3. Network & remote access
The hardware on which client data is primarily stored is on a private work network, with no inbound ports forwarded from the internet. Remote access is through Tailscale, a private network built on the WireGuard protocol on which traffic is encrypted end to end. Access to that network is restricted to devices authorized by Aurora.
Aurora's website is served exclusively over HTTPS.
4. Endpoint security
Aurora-managed computers used to access client data have operating system integrity protection and application verification enabled, receive operating system updates regularly, lock the screen when idle, and do not log in automatically.
5. AI tools & model training
Aurora does not use client data to train or fine-tune artificial intelligence models. Model training on customer content is disabled in the AI tools Aurora uses, which are:
| Tool | Use | Model training |
|---|---|---|
| ClaudeAnthropic, PBC | AI assistant and coding tool (Claude, Claude Code) for research, drafting, analysis, and building client automations | Disabled for customer content |
| ChatGPTOpenAI, L.L.C. | AI assistant for research and drafting | Disabled for customer content |
| FathomFathom Video, Inc. | AI meeting recording, transcription, and summaries | Disabled for customer content |
| GranolaGranola AI, Inc. | AI meeting transcription and note-taking | Disabled for customer content |
| SanaSana Labs AB | AI meeting notes and knowledge assistant | Disabled for customer content |
Aurora does not itself make decisions about individuals based exclusively on automated processing. Automations that Aurora builds for a client run on the client's instructions, within the client's own platforms, and the client is responsible for reviewing their output.
Where Aurora uses AI note-taking tools to record or transcribe meetings, it does so with notice to participants. Participants may ask that a meeting not be recorded.
6. Client-owned platforms
Aurora typically builds and operates automations within software platforms licensed by the client, so the client's operational data remains in the client's own systems. Those platforms are engaged by the client under its own agreements and are not Aurora's sub-processors. Aurora accesses them only with the credentials and permissions the client provides, and returns credentials and removes its access when the engagement ends.
7. Security incidents
Aurora will notify an affected client without undue delay after becoming aware of a breach of security safeguards involving personal data that Aurora processes for that client, and will cooperate with the client in meeting its own obligations. Section 7 of the DPA sets out these obligations.
8. Retention & deletion
Aurora retains client data only for as long as necessary to perform the services. When an engagement ends, Aurora returns or deletes client data at the client's choice, subject to the exceptions in section 12 of the DPA. Retention periods for other information are described in the Privacy Policy.
9. Compliance
Aurora handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) and, where applicable, Quebec's Act respecting the protection of personal information in the private sector. Where Aurora acts as a service provider to a client that is subject to United States state privacy laws, Aurora provides the contractual commitments in section 14 of the DPA. Aurora's Privacy Officer is accountable for compliance.
Aurora does not currently hold SOC 2 or ISO/IEC 27001 certification.
10. Vendor review documentation
- Data Processing Addendum
- Sub-processors (updated 2026-10-29)
- Privacy Policy
- Terms of Service
Security questionnaires, requests for a countersigned DPA, and other inquiries may be directed to:
Frequently asked questions
Does Aurora Designs use client data to train AI models?
No. Aurora does not use client data to train or fine-tune AI models, and model training on customer content is disabled in the AI tools Aurora uses.
Where does Aurora Designs store client data?
Primarily on an encrypted volume on Aurora-owned and Aurora-managed hardware. Client data may also be held in other Aurora-controlled encrypted storage and in the services listed on Aurora’s sub-processor page.
Who at Aurora Designs can access client data?
Only Aurora personnel and subcontractors who require access to perform the services and who are bound by written confidentiality obligations.
Does Aurora Designs hold SOC 2 or ISO 27001 certification?
No. Aurora describes its safeguards on this page and in its Data Processing Addendum, and responds to security questionnaires on request.
Will Aurora Designs sign a Data Processing Addendum?
Yes. Aurora’s standard DPA is published at aurora-designs.ca/dpa, and Aurora will review a client’s own terms on request to [email protected].