Access Control Policy

The purpose of this Access Control Policy is to establish the controls, responsibilities, and security practices used by Aware AI to protect systems, applications, infrastructure, and sensitive information from unauthorized access. This policy defines how access is granted, reviewed, modified, and revoked across Aware AI systems and services.

This policy applies to employees, contractors, administrators, third-party service providers, cloud infrastructure, production systems, development environments, internal tools, databases, AI orchestration systems, and user data and memory systems.

Aware AI follows the principle of least privilege. Access to systems and data is limited to authorized users, restricted based on operational necessity, segmented by role and responsibility, reviewed periodically, and revoked when no longer required. Users are granted the minimum level of access necessary to perform approved business functions.

Aware AI uses centralized authentication and identity systems to manage access to internal and production systems. Security measures include authenticated user sessions, access-token validation, environment-specific credentials, restricted administrative access, session expiration controls, and password and credential management through trusted providers. Administrative and privileged access is limited to authorized personnel only.

Aware AI implements role-based access control mechanisms across infrastructure and application systems. Roles are assigned according to job responsibilities and operational requirements. Examples of role segmentation may include standard user access, administrative access, infrastructure management access, development access, and analytics or support access. Sensitive operations and production systems are restricted to approved roles.

Access to production systems is restricted to authorized personnel with a legitimate operational need. Production access controls include restricted administrative privileges, environment separation between development and production, audit logging for critical administrative actions, controlled access to infrastructure management tools, and access restrictions for sensitive databases and orchestration systems. Direct access to production data is limited and controlled.

Aware AI implements user-scoped access protections for conversational memory, vector retrieval systems, and contextual intelligence services. Controls include user-isolated memory retrieval, permission-scoped contextual systems, controlled orchestration access, restricted administrative access to production data, and access logging and monitoring. Aware AI is designed to prevent unauthorized cross-user access to memory or contextual information.

Access to third-party integrations and connected services is limited to permissions explicitly authorized by the user. Examples may include email providers, calendar systems, cloud storage providers, financial integrations, and AI model providers. Aware AI only requests permissions necessary for platform functionality.

Aware AI periodically reviews access permissions and administrative privileges to ensure access remains appropriate. Reviews may include administrative account reviews, infrastructure access verification, environment permission reviews, and credential and integration audits. Excessive or unnecessary access is removed when identified.

Access is revoked or modified when personnel no longer require access, roles or responsibilities change, credentials are suspected to be compromised, security incidents occur, or vendor or contractor relationships end. Unused or unnecessary credentials may be disabled or removed.

Aware AI maintains logging and monitoring systems designed to identify unauthorized access attempts, suspicious authentication activity, failed login attempts, administrative changes, infrastructure anomalies, and persistence and orchestration errors. Security-related logs may be reviewed during operational or security investigations.

Sensitive systems and data are protected using encrypted communications (TLS), encrypted cloud storage, environment-specific credentials, access restrictions, scoped authorization rules, and infrastructure-level protections.

Personnel with access to Aware AI systems are responsible for maintaining credential confidentiality, using approved authentication methods, following security procedures, reporting suspected security incidents, and avoiding unauthorized sharing of credentials or access. Shared credentials are prohibited.

Unauthorized access, misuse of credentials, or attempts to bypass security controls may result in access suspension or termination, investigation and remediation actions, contract termination, or legal action where appropriate.

Aware AI may update this Access Control Policy periodically to reflect operational, security, infrastructure, or regulatory changes.

Questions regarding this policy may be directed to support@stayaware.ai.