Your data stays yours.
AetherDesk is built for organizations that can't compromise on data protection. Here's exactly how we handle your information — in plain language.
Your data never trains AI models.
AetherDesk's AI features run on Amazon Bedrock. Your prompts and the AI's responses are not used to train or improve any AI model, are not shared with model providers or other third parties, and are not retained by the model service after your request is processed. AI processing stays within US-based AWS regions.
- Not used to train or improve AI models
- Not shared with model providers or other third parties
- Not retained by the model service after your request is processed
- Processed within US-based AWS regions
Human-in-the-loop, least-agency AI.
AetherDesk's AI operates under a deliberately limited-authority design. The AI can classify issues, route them to the right team, and create support records — but it cannot approve changes, modify or delete data, access other users' information, or execute administrative actions. Every AI output is validated by deterministic server-side code before any record is created, and consequential actions like change approvals always require a verified human decision, enforced by role-based access control. The AI proposes; humans and validated code dispose.
- Can classify, route, and create support records
- Cannot approve changes, modify or delete data, or run administrative actions
- Cannot access other users' information
- Every AI output validated by deterministic server-side code before any record is created
- Consequential actions require a verified human decision, enforced by role-based access control
No AI model can be made fully immune to manipulation — which is why our security model assumes it, constraining what any manipulated output could ever cause, monitoring for manipulation attempts, and keeping humans in control of every consequential action.
Sensitive data is masked before AI ever sees it.
AetherDesk includes a built-in data-loss-prevention (DLP) layer that runs on every incoming message before it is stored or sent to the AI. Credit card numbers (validated with a Luhn check), Social Security numbers, and passwords are automatically detected and redacted — so the raw values never reach the database and never reach the model. Only the masked text is stored and processed.
- Credit card numbers, SSNs, and passwords detected and redacted
- Redaction runs before storage and before any AI processing
- Raw values never reach the database or the model
Isolation by design.
Your organization's data is separated from every other tenant, and access is scoped to the people and roles that need it. People sign in through your own identity provider rather than a separate password held by us.
- Per-tenant data isolation
- Encryption in transit (TLS) and at rest
- Least-privilege access controls
- Sign-in through your identity provider — SSO / Entra ID ready
Where AetherDesk runs.
AetherDesk runs on Amazon Web Services in US regions. Its AI is powered by Amazon Bedrock — with the option for organizations to bring their own approved model endpoint — and identity is handled by Amazon Cognito, a managed identity service providing multi-factor authentication, session-scoped tokens, and role-based access control. Internally, every component follows least-privilege access principles.
AetherDesk is built for Microsoft-centric environments: organizations running Microsoft 365 are our primary audience. Microsoft Entra ID single sign-on is on the roadmap for tenant sign-in, federating through the same managed identity layer.
- Runs on Amazon Web Services, in US regions
- AI powered by Amazon Bedrock — bring-your-own approved model endpoint optional
- Identity via Amazon Cognito — MFA, session-scoped tokens, and role-based access control
- Least-privilege access for every internal component
- Built for Microsoft 365 organizations; Microsoft Entra ID SSO on the roadmap
Auditability.
Every ticket action, approval, and change is recorded against a verified, signed-in identity — not a free-text name someone typed. Approval workflows enforce roles on the server: a step that requires a manager or CAB approver checks the caller's verified group membership, so approvals can't be granted by anyone who lacks the role.
- Actions, approvals, and changes recorded against a verified signed-in identity
- Roles and approvals enforced server-side — not on the honor system
Your model, your choice.
Available on requestFor organizations with strict data-sovereignty requirements, AetherDesk's architecture supports routing AI processing to a model endpoint you designate — for example, a model hosted in your own account or region.
Compliance & certifications.
We publish our compliance posture honestly, including what's not done yet — standards not listed here haven't been evaluated for our roadmap.
| Standard | Status | Notes |
|---|---|---|
| SOC 2 Type II | Planned | Engagement targeted following first production customers. |
| WCAG 2.1 AA / Section 508 | In development | Formal accessibility audit scheduled before government deployments. |
| StateRAMP | Roadmap | Pursued alongside first state/local deployments. |
| CJIS | Roadmap | For justice-adjacent workloads. |