Privacy policy.

Account data

When you sign in via Microsoft 365 SSO or Google OAuth, we receive your email address, display name, and tenant/organization identifier. Aorka does not store passwords — authentication is delegated entirely to your identity provider. We also record the IP address and user agent of your sessions for security auditing.

Infrastructure data

Aorka's core function is managing your IT infrastructure. This means we store data about your endpoints: hostnames, hardware facts, software versions, configuration details, and other operational data collected by the agent or entered by your team. This data is what makes the knowledge base useful — it's the whole point of the product.

Conversations and scripts

Chat conversations with the AI assistant are stored so you can reference prior context. Scripts generated or executed through the platform are logged with their safety scores, approval status, and execution results. This history is essential for audit trails and for the AI to learn your environment over time.

Credentials

If you store credentials in the Aorka vault, they are encrypted at rest using AES-256-GCM. Viewing a stored credential requires MFA verification — a session alone is not sufficient. We cannot read your stored credentials in plaintext; decryption happens on-demand when you explicitly request access.

Session cookie

Aorka uses a single session cookie to maintain your authenticated session. That's it. No analytics cookies, no tracking cookies, no third-party cookies. We do not use Google Analytics, Mixpanel, Hotjar, or any similar service.

Role-based access within tenants

Within your tenant, access is controlled by role-based permissions (admin, tech, viewer) and unit-scoped access grants. A user only sees the endpoints and data they've been explicitly granted access to. Tenant admins control who gets access to what.

Concept clusters and cross-tenant signals

While your data content is strictly tenant-isolated, Aorka uses a global relevance system to improve knowledge quality across the platform. Here is exactly how it works:

1. Each knowledge item is converted into a vector embedding — a list of numbers representing the item's meaning in abstract mathematical space. This is a one-way transformation; the original text cannot be reconstructed from the vector.
2. Vectors from all tenants are grouped into concept clusters using density-based clustering. A concept is a geometric centroid (average position) of nearby vectors — it has no name, no label, and no readable content. It's a point in mathematical space.
3. Each concept has a salience score reflecting how actively that type of knowledge is being used across the platform. When many items in a concept cluster are accessed frequently, the concept's salience rises; when activity is low, it falls.
4. Salience changes propagate to nearby items. If the "firewall configuration" region of the vector space is heating up across the platform, your firewall-related items benefit from that signal — they rank higher in search results and get validated more frequently.

What crosses tenant boundaries: Mathematical coordinates (vectors) and numerical relevance scores. What never crosses: Titles, descriptions, fact values, hostnames, IP addresses, credentials, or any other readable content. No tenant can reverse-engineer another tenant's data from concept clusters — the vectors are abstract, high-dimensional, and irreversible.

Where your data lives

All Aorka infrastructure runs in AWS us-east-1 (Northern Virginia). The application server runs on AWS Lightsail. The database is AWS RDS PostgreSQL with encryption at rest enabled. Application secrets are stored in AWS Secrets Manager with IAM-scoped access policies.

International data transfers

Aorka currently operates exclusively in the US (us-east-1). We do not have an EU data center at this time. If you are located outside the United States, your data will be transferred to and processed in the US. We are transparent about this rather than burying it in fine print. If regional data residency is a requirement for your organization, please contact us to discuss your needs.

Encryption

All data in transit is encrypted via TLS. The database uses encryption at rest via AWS RDS. Stored credentials use AES-256-GCM application-layer encryption on top of database encryption. Agent connections use WSS (WebSocket over TLS) with mutual authentication.

You control your data

Conversations, facts, credentials, and knowledge base entries can be deleted by authorized users directly through the platform. Deletion is immediate — we don't soft-delete and retain data behind the scenes.

Account deletion

Tenant admins can request full account deletion by contacting us. We will delete all tenant data — endpoints, facts, conversations, credentials, scripts, and user records. Audit logs may be retained for up to 90 days after account deletion for security purposes, after which they are permanently deleted.

Backups

AWS RDS automated backups are retained per AWS default retention policy. When data is deleted from the live database, it will naturally age out of backups as they rotate.