Aetos Data Consulting

Client information is only as safe as the accounts that can reach it, so access is narrow by default and checked on a schedule.

• Single sign-on and multi-factor authentication on every business tool
• Least-privilege roles, with administrator access granted only for a set period
• Access removed within one business day when someone's work for Aetos ends
• Access to sensitive systems reviewed every quarter

Client information is confined to devices designated for client work. Each of those devices meets the same baseline below, and client data does not move to any other device or personal account.

• Screen lock after inactivity
• Automatic updates for the operating system, browsers, and core applications
• Centrally managed malware protection
• Client data kept only on designated devices

Aerie, the client workspace, and the Talon Peak tabletop platform have security built into their defaults.

• Authenticator code required at every Aerie sign-in, with lockout after 5 failed attempts and a lock after 30 minutes idle
• Each client's data separated in the database, with automated tests on every change
• Uploads scanned for malware before anyone else can open them
• Files opened only through links that expire in 5 minutes
• An audit log of every sign-in, view, download, and change that no one can edit
• Encryption in transit and at rest, with daily backups

Each type of client information has a set retention period, recorded in the Data Processing Addendum, and deletion runs on that schedule.

• Engagement files deleted on the schedule your agreement sets, with 7 days' notice in Aerie
• Legal holds pause deletion when needed
• Snapshot and TPS Report deletion requests completed within 30 days
• Backup copies expire on a fixed cycle and are used only for recovery
• A copy of your content available to export before deletion

The tools Aetos uses are part of your risk, so each one is checked before it is used and reviewed after.

• A signed data processing agreement before any client data reaches a vendor
• A security screen covering security practices, encryption, and SOC 2 or ISO 27001 reports
• Vendors tiered by sensitivity and reviewed quarterly, semiannually, or annually
• AI tools only on business or API terms that bar training on client data, with Aetos reviewing anything they draft
• At least 30 days' notice before a new subprocessor handles client data, with a right to object
• The current list of subprocessors is in the Trust Center

If a security incident affects your data, you are told without undue delay and within the deadline in your agreement. Notice does not wait for the investigation to finish.

• Initial notice with what is known, followed by updates as facts are confirmed
• Containment, recovery, and credential resets
• A root-cause review, with improvements to detection
• Support for your own notices to regulators or affected people

For client work, Aetos acts as your processor: your organization decides what is shared and why, and Aetos follows your instructions. Aetos acts as a controller only for its own business records. Anyone can ask to access, correct, export, or delete their information.

• Privacy requests: privacy@aetos-data.com
• Security reports: security@aetos-data.com