aimis.
A Vendidit company
Request a walkthrough
Security and data/Trust center

Security and data handling, stated plainly.

What leaves the device. Who processes it. What is kept, and who controls it. This page states what AIMIS does today. Detailed documentation is available to organizations in an active evaluation.

Request the security overview Report a vulnerability
Deployment · today · cloud application on AWS
03 · Cloud
AWSOperated by Vendidit. Shared infrastructure, logically separated per organization.
02 · In transit
TLSEncrypted connections from the phone and the browser.
01 · Phone
Capture deviceiOS or Android. Nothing stored beyond capture.
Principle

We state what we hold, and nothing we do not.

AIMIS works with each organization and its partners on the requirements of the engagement. Where a requirement is not yet met, this page says so and the engagement plan says how.

That posture is deliberate. An organization evaluating the product should be able to rely on every sentence here. Items marked Confirm are facts still to be supplied before this page goes live. Nothing marked ships.

Five areas

Each stated plainly, each with its own page.

AreaWhat is true todayDetail
01Hosting and infrastructure

Records are processed on Vendidit operated infrastructure hosted on Amazon Web Services. Regions: us-east-1 (single region — compute, storage and database).

Architecture and deployment →
02Deployment models

A cloud application operated by Vendidit. The phone is the capture device. Shared infrastructure today, logically separated per organization; dedicated tenancy has not been built. Isolated or on premises deployment is not offered today.

Architecture and deployment →
03Data in transit and at rest

Photographs and item data are transmitted over encrypted connections (TLS in transit). At rest: object storage is encrypted with AES-256 (AWS-owned keys, no third-party key-management service). Database storage encryption: AES-256 (AWS-owned keys)

Data handling and retention →
04Access and administration

Access is role based, administered by each moving company's own staff accounts, alongside each customer's self-service account. Audit events: every custody action on a record — capture, lock, receiving check, identification confirmation — is written to a tamper-evident, hash-chained log.

Data handling and retention →
05Compliance posture

No third party certifications are held today. Security documentation is available on request. Certifications in progress are listed only once begun.

Compliance and accessibility →
Document library

What a reviewer can ask for.

Public documents are linked. Everything else is provided under non disclosure agreement to organizations in an active evaluation.

DocumentWhat it coversAvailability
Security overviewHosting, separation, data handling, access, incident handling in plain languageOn request
Architecture diagramPhone, transport, processing, storage, exportOn request
Data flow and retention summaryWhat is collected, where it goes, how long it stays, who can delete itOn request
Subprocessor listEvery third party that processes customer dataPublic · below
Data processing termsContractual terms on data handlingUnder NDAConfirm
Vulnerability disclosure policyHow to report, what to expect, safe harborPublic
Incident response summaryDetection, customer notification within 48 hours of confirmation, customer communicationOn request
Accessibility conformance reportWCAG 2.1 AA status for the app and this site Confirm statusOn request
Business continuity summaryContinuous backups with point-in-time restore (3-day retention); formal recovery objectives not yet documentedOn request
Subprocessors

Every third party that touches customer data.

The list is public and kept current. The identification architecture is provider agnostic, so the service can be changed without changing the product.

ProviderPurposeData involvedLocation
Amazon Web ServicesHosting and storage of the application and recordsPhotographs, item data, account dataUnited States (us-east-1)
Identification serviceCommercial, provider agnostic
Item identification and comparable-sale pricing from photographs, reviewed by a staff member before it becomes part of the record. The architecture is provider agnostic and the service can be changed without changing the product.Photographs and derived item dataUnited States
HubSpotWebsite forms and inquiry routingContact details submitted on this siteUnited States
SentryError and performance monitoringError reports and performance traces. Personal data collection is off by default.United States
SendGridEmail deliveryRecipient address and message content for account and transactional emailUnited States
Security inquiriessecurity@aimiscustody.com

For reviewers and assessors. Response within Confirm business days.

Write to security →
Vulnerability reportsReport a vulnerability

Public disclosure policy with safe harbor. Acknowledgement within Confirm business days.

Read the policy →
Data requestsDeletion and export

Deletion is in the customer's control. Location metadata retention is configurable and can be stripped on request.

Data handling and retention →

Request the security overview.

Provided to organizations in an active evaluation, under non disclosure agreement.

Request the security overview