Aurora processes event data for 640+ teams, much of it about their customers. This page is the honest version of how we look after it — the certifications, the sub-processors, the encryption, and what happens on the worst day.
Audited annually by an independent CPA firm against the Security, Availability and Confidentiality trust services criteria. The most recent report covers a twelve-month observation window ending 31 December 2025 and is available under NDA from security@aurora.io.
Certified by a UKAS-accredited certification body, covering the Aurora platform, the supporting cloud infrastructure and the London office. Surveillance audits run annually with full recertification every three years.
Aurora Labs Ltd is registered with the Information Commissioner’s Office under number ZB512884. We act as processor for customer event data and as controller for our own account and billing records, and our data processing agreement is available at signature without negotiation for standard terms.
Certified annually, including the hands-on technical audit of workstation patching, malware protection, access control and firewall configuration. Certificates are reissued each June.
Aurora never stores cardholder data. Billing is handled end to end by our payment processor and we complete SAQ-A each year. If you send us card numbers as event properties, our schema validator rejects them.
Two independent CREST-accredited tests every year — one full-scope application test and one infrastructure and cloud configuration review — plus a targeted test before any major architectural change ships.
Every connection to Aurora is TLS 1.3 with forward secrecy. TLS 1.2 remains available for legacy server SDKs and everything older is refused outright; HSTS is enabled with preload, and our certificates are issued with a 90-day lifetime and rotated automatically.
New workspaces are provisioned in AWS eu-west-2 (London) and stay there. Enterprise customers who need EU-only processing can be pinned to eu-central-1 (Frankfurt) at provisioning time; the choice is made once and cannot drift afterwards.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, storage, managed databases | London (eu-west-2), Frankfurt (eu-central-1) |
| Cloudflare Ltd | CDN, DDoS mitigation, web application firewall | EU edge network, no origin storage |
| Datadog EU | Infrastructure monitoring, application logs, alerting | Frankfurt, Germany |
| Twilio SendGrid | Transactional email — alerts, reports, account notices | Dublin, Ireland |
| Zendesk International Ltd | Customer support ticketing and knowledge base | Dublin, Ireland |
| Stripe Payments Europe Ltd | Subscription billing and payment processing | Dublin, Ireland |
| Slack Technologies Ltd | Shared support channels for Enterprise customers | EU region, Enterprise Grid |
| Snowflake Computing Netherlands B.V. | Optional warehouse destination, provisioned only at customer direction | Frankfurt, Germany |
We give 30 days’ written notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds. To be added to the notification list, email security@aurora.io. The current list is also annexed to our data processing agreement — see the privacy notice for the full picture.
| Data | Default retention | Notes |
|---|---|---|
| Raw event data | 30 days (Starter) · 13 months (Growth) · configurable (Enterprise) | Deleted from live storage and from backups on the next rotation. |
| Identified user profiles | Lifetime of the workspace | Erasable per subject on request; propagates to synced warehouses. |
| Aggregated metrics | 25 months | Non-reversible aggregates retained for year-on-year comparison. |
| Audit logs | 13 months (up to 7 years on Enterprise) | Immutable, exportable to your SIEM via the audit log API. |
| Encrypted backups | 35 days | Point-in-time recovery within the same region; never replicated outside it. |
| Support correspondence | 24 months | Held in Zendesk under our own controller obligations. |
| Closed workspaces | Purged 30 days after termination | Extended only where you ask us in writing to hold data for migration. |
Erasure requests from your end users are actioned through the API or the dashboard and complete within 30 days, including in downstream warehouse destinations we sync to. Deletion is real deletion, not a hidden flag on a row.
A CREST-accredited firm tests the full application surface every spring and the cloud and network estate every autumn, with an additional targeted engagement before any significant architectural change. Summary letters are available under NDA; findings are tracked to closure with critical issues fixed inside seven days.
Report anything you believe affects the security of Aurora to security@aurora.io. We acknowledge within one working day, give you a triage decision within three, and keep you updated until it is closed. Our PGP key and policy are published at /.well-known/security.txt on aurora.io.
Continuous monitoring, anomaly detection on our own platform and a 24/7 on-call rotation. Severity 1 incidents are acknowledged within fifteen minutes, at any hour, by a named engineer.
The on-call engineer has standing authority to isolate a component, revoke credentials or fail a region over without waiting for a manager. Containment comes before root cause, every time.
Affected customers are told without undue delay through the status page and a direct message to your named security contact. Where a personal data breach is notifiable, we report to the ICO within 72 hours under Article 33 of the UK GDPR and support your own notification obligations.
A fix ships, then the class of problem gets closed off — a monitor, a test, or an architectural change — before the incident is considered resolved.
A blameless post-incident review is written up and shared with affected customers within ten working days, including timeline, impact and the specific commitments we have made.
Send vendor security questionnaires, data processing agreements and audit requests to our security team and you will get a completed response, not a link to a portal. Our Data Protection Officer can be reached at the same address.
Aurora Labs Ltd · Registered in England 09417732Tell us which questionnaire you are working through and we will send the SOC 2 report, ISO certificate and DPA the same day.