Security

Every company kept apart

Every record in Aerie belongs to one company, and the database itself refuses to show it to anyone outside that company. The same rules apply on the phone, in the browser and to anything connected to Aerie.

Inside a company, people see what their role allows: Crew, Crew lead or Admin, with permissions an admin can adjust per person. Admin-only tasks are hidden from everyone without the permission.

Sign-in

• No passwords to reuse or leak: people sign in with a code sent to their work email.
• A second step with an authenticator app: anyone can turn it on, and a company can require it for its admins or everyone.
• Sessions end after a week without use, and a person removed from the team loses access at once.

Gate, door and alarm codes

• Codes are kept apart from the rest of a property and shown only to people who need them.
• Every time a code is shown, Aerie logs who saw it and when.
• Codes are never sent to the AI helpers, to calendars or to connected apps.
• The copy of codes a phone keeps for working offline lasts a few days; on the iPhone app it’s sealed with a key that never leaves the phone.

Encryption and storage

• Everything travels over encrypted connections (HTTPS with HSTS).
• The database runs on Supabase in the United States (Oregon); photos, videos and backups are stored with Cloudflare R2 in North America. Both encrypt stored data.
• Photos are opened through short-lived signed links, never public addresses.
• Client photo reports are shared by an unguessable link that expires and can be turned off, and search engines are told not to index them.

Backups and your data

• A company keeps its 8 latest backups in Aerie and can restore one itself.
• Every night an encrypted copy of each company’s data goes off-site, locked against deletion for 30 days and kept for a year.
• Deleted items wait 30 days in the Trash before they’re gone.
• An admin can download all of the company’s data at any time.
• An activity log records every change, by people and by AI, with what it was before.

AI

The AI helpers are optional and ask before each use. What they send goes to Anthropic (and, for Aerie Notes, Cloudflare Workers AI) under terms that don’t let them train on it. An admin can switch them off for the whole company. AI in Aerie.

Reviews and reporting a problem

Aerie’s code and settings were reviewed for security and privacy in October 2026, and the findings that needed code changes were fixed. We don’t claim certifications we don’t have: Aerie isn’t SOC 2 audited yet.

Found a security problem? Email support@hawkaerie.app with “Security” in the subject. We’ll answer within two business days.

Who handles your data, and where: subprocessors. How we handle it: privacy policy and data processing addendum.