Every commitment below says how it is enforced. Where a machine refuses to break it, we name the check. Where nothing but our word holds it, we say that in the same sentence — because a promise presented as a mechanism is worse than no promise at all.
This site runs no scripts, sets no cookies, and collects no analytics. Nothing on this page is fetched at read time: every fact here was written down when the page was published, and each one names where you can check it yourself.
What actually protects your data: encryption in transit, row-level isolation enforced by the database and gated in CI, and automated secret scanning over the whole repository history — together with the one isolation gap that is currently open and being repaired.
SecurityThe hard limits the Avieros AI operates under, written down and versioned: it answers to a human, it never reports a result it did not get, and Candidate Watch stays party-neutral and proof-based. Each limit says whether a gate enforces it or a person does.
AI boundariesWhich outside companies process Avieros data, what each one touches, and where it runs. Both the ones processing data today and the ones configured but switched off, kept apart — an incomplete list read as a complete one is the specific way this disclosure misleads.
SubprocessorsAvieros holds no third-party security or compliance certification — no SOC 2, no ISO 27001, no HIPAA attestation — and this Trust Center does not imply one anywhere. The Compliance page states each item, its real state, and what would have to happen to change it.
ComplianceThree kinds of thing appear on trust pages and they are usually printed identically. Here they are not. Enforced by machine means something in the running system refuses to do it, and the check is named. Enforced by absence means the capability to break it was never built. Declared means our word, a policy, and nothing mechanical — a real commitment, but you should know which kind it is.
| Commitment | How it is held | Where to check it |
|---|---|---|
| We never use one member’s data to compete with them | Enforced by machine. The tables that learn across businesses cannot store a row drawn from fewer than five, and carry no per-business identifier at all. The database rejects the write; it is not a rule someone remembers to follow. | vertical_pattern_observations.business_count >= 5 and vertical_playbooks.source_business_count >= 5, with triggers *_aggregate_only running reject_member_identifying_aggregate. Live in the production database. |
| The published ranking cannot quietly stop matching the real one | Enforced by machine. A test compares the published methodology against the constants the running ranking kernel uses and fails the build when they differ, so the page cannot drift from the system it describes. | apps/pilot-search/tests/methodology.test.js — “methodology payload mirrors the live ranking kernel exactly”. Published copy at Methodology and Transparency. |
| You cannot buy a ranking position | Enforced by absence, and asserted. There is no advertising system to switch on, and the same build test asserts that ad spend and sponsored placement remain refused rather than merely unused. | The methodology contract asserts independence.ads.live === false and that real_ad_spend and sponsored_launch are blocked actions. |
| Secrets never reach the repository or a browser bundle | Enforced by machine. Every push is scanned across the full git history, and a separate check looks for credentials inside shipped client bundles. Either one failing stops the build. | .github/workflows/security.yml (gitleaks over history) and scripts/proof/secret-scan.mjs. |
| One business cannot read another’s data | Enforced by machine, with one open exception we are not hiding. Row-level security is on and CI both proves isolation holds and proves the check itself can fail. One internal worker table is currently readable by any signed-in account. It is a known defect, it is being repaired, and it is named here rather than left for someone else to find. | scripts/proof/rls-enabled-coverage.mjs and scripts/proof/rls-isolation-ci.mjs (which runs --prove to show the gate can fail). Open defect: WORKER-TABLE-RLS-ANY-AUTHENTICATED. |
| Your data is never sold, rented, or shared for someone else’s marketing | Declared. No mechanism prevents a future company from breaking this; it is a commitment, held by policy and by the absence of any such pipeline. What is mechanical is your side of it: access, export, correction and deletion are self-serve and working today. | Privacy & Data Rights, and the live portal at avieros.com/data-rights. |
| You own what you build, and can take it with you | Declared, with a platform ledger. Ownership, stakes and transfers are recorded so the rights are real inside Avieros. That ledger is not legal title, and it does not replace your registrar, cap table, or lawyer. | Commitments & Charter — and the boundary is stated there rather than implied away. |
| External security certification | Not claimed. Avieros holds no SOC 2, ISO 27001, HIPAA, or equivalent third-party attestation. No badge, wording, or layout on this site is intended to suggest otherwise. | Stated here, on Commitments, and on Security. It will be stated on the Compliance page when that page exists. |
The two strongest commitments — never competing with members, and members owning what they build — are in force today as operating doctrine. What is pending is formal Foundation ratification: the step that puts them beyond any one person’s ability to reverse, with a published signature of the ratified text. Until that signature exists we will not say it does, and this page will change when it does.
A Trust Center that cannot be replied to is decoration. These addresses are monitored by people:
Don’t take this site’s word for it — these are live on avieros.com today and you can check them yourself: