What Athena can access.
Athena receives only the access the workflow needs. The deployment documents every model, API, tool, database, data type, service identity and administrative permission involved.
// Trust Centre
Trust at a glance.
Where customer data is processed.
You choose: an Aelethion-managed EU region, your own cloud account, on-premise or air-gapped. The data-flow documentation states what stays inside your boundary.
What Aelethion stores.
Customer-controlled and on-premise deployments keep all business data, logs, keys and evidence inside your environment. Hosted deployments document what is stored, where, for how long, who can access it and how it is deleted.
Who controls the keys and evidence.
You hold the signing material and retain your evidence independently of Aelethion. Key generation, custody, rotation and recovery follow your deployment.
Whether Athena connects to Aelethion.
In a customer-controlled deployment, network paths depend on the interfaces, updates, licensing and support arrangements agreed for that configuration. An air-gapped configuration with local model weights is designed to operate without external connections. Hosted deployments document their required connections before production.
How evidence is checked.
Evidence is verified offline with the public key and the free verifier. The reviewer needs no Aelethion account and no connection to our servers.
// Trust Centre
Security architecture and access.
// Trust Centre
Customer data and privacy.
// Trust Centre
Deployment and sovereignty.
Hosted.
- Where Athena runs
In an Aelethion-managed EU region.
- Customer control and connectivity
Region, storage, support access, keys, retention and external connections are documented for the service.
Customer-controlled cloud.
- Where Athena runs
Inside the customer's cloud account or dedicated environment.
- Customer control and connectivity
The customer controls the configured infrastructure, network policy, data stores, keys and evidence stores.
On-premise.
- Where Athena runs
Inside the customer's data centre or private environment.
- Customer control and connectivity
Customer-controlled operation with only the approved model, database, update and support paths enabled.
Air-gapped.
- Where Athena runs
Inside a disconnected customer environment.
- Customer control and connectivity
No external connection during normal operation; local dependencies and offline installation, update and licensing procedures apply.
// Trust Centre
Operations, resilience and system lifecycle.
// Trust Centre
Independent offline verification.
// Trust Centre
Security testing and customer validation.
// Trust Centre
Trust and diligence documents.
Public legal and privacy documents.
Privacy Policy.
Explains what personal data Aelethion collects, why it is processed, how it is protected and retained, the lawful bases relied upon and the rights available to data subjects.
Terms of Service.
Sets out the contractual terms governing access to and use of Athena and related services, including customer responsibilities, acceptable use, intellectual property, availability, liability and termination.
Data Processing Agreement.
Governs Aelethion's processing of personal data on behalf of business customers, including documented instructions, confidentiality, security measures, sub-processors, assistance, breach notification, deletion and audit rights.
Sub-processor list.
Identifies third parties used to provide relevant infrastructure or operational services, the purpose for which each is used and the location or transfer mechanism relevant to processing.
Cookie information and preferences.
Explains the cookies and similar technologies used on the public website, their purpose and the controls available to the visitor.
Vulnerability disclosure.
Explains how to report a suspected security issue, the information to include and how Aelethion coordinates responsible disclosure.
Guides and checklists.
Article 10(5) readiness checklist.
A one-page checklist for digital labour platforms preparing for the Platform Work Directive: which decisions are in scope, whether a human takes them, the reasons and review owed to the worker, and what you can prove.
Controlled security-review material.
The following material is supplied as relevant to the selected deployment and the stage of the customer review:
Security overview and assurance pack.
- What it answers
Summarises architecture, controls, responsibilities and operating model.
- Typical access
Customer review
Architecture and data-flow diagrams.
- What it answers
Shows components, trust boundaries, data types, storage, connections and evidence paths.
- Typical access
Under NDA where appropriate
Privilege, network and storage requirements.
- What it answers
Identifies service identities, permissions, ports, endpoints, storage and administrative access.
- Typical access
Customer review
Deployment and integration guide.
- What it answers
Explains installation, configuration, supported control points, failure behaviour and removal.
- Typical access
Customer review
Update, licensing and offline-operation procedures.
- What it answers
Explains signed delivery, approval, rollback and restricted-environment operation.
- Typical access
Customer review
Evidence-format and verifier documentation.
- What it answers
Explains the sealed record, the verification sequence, the keys and the checks.
- Typical access
Public or customer review, depending on the item
Sample evidence and test records.
- What it answers
Allows the customer to run verification and tamper-detection tests before production use.
- Typical access
Evaluation review
Regulation and assurance mappings.
- What it answers
Shows how the evidence supports each named obligation.
- Typical access
Customer review
Incident response, continuity and exit summaries.
- What it answers
Describes escalation, recovery, responsibilities, data handling and decommissioning.
- Typical access
Customer review
Some security material contains sensitive architecture or test details and may require an NDA or an active customer review. Public documents remain accessible without a sales process.