Replace code reviews with verified intentAviator Verify
Aviator

Legal

Security

Aviator runs in some of the most security-sensitive engineering organizations in the world. We treat the protection of your source code, your metadata, and your audit trail as a first-class engineering problem, not a checkbox.

Certifications & compliance

  • SOC 2 Type II — audited annually by an independent third party. Reports available on request to existing and prospective customers under NDA.
  • GDPR — Aviator processes personal data on behalf of our customers as a data processor under the EU GDPR and UK GDPR.
  • HIPAA — available on request for customers operating in regulated healthcare environments.

Up-to-date reports, sub-processor lists, and certificates live on our Trust Center.

Access controls

  • SAML / OIDC-based single sign-on for all customer plans that support it.
  • Granular role-based access control at the workspace, repository, and queue level.
  • Just-in-time, time-bounded production access for Aviator engineers.
  • Comprehensive, exportable audit logs of every privileged action.

Data protection

  • Encryption in transit (TLS 1.2+) and at rest (AES-256) by default.
  • Tenant isolation at the database row level; no shared application secrets across tenants.
  • Customer-managed encryption keys available on enterprise plans.
  • Annual penetration testing by third-party security firms.

Deployment options

Aviator can run as a managed SaaS in our hardened multi-tenant environment, in a dedicated single-tenant environment, or fully on-prem inside your own cloud account. The on-prem bundle ships as a small set of containers with no outbound calls except where you opt in. See the on-prem installation guide for details.

Incident response

  • 24/7 on-call rotation with documented severity ladders.
  • Customer notification within 72 hours of any confirmed material incident.
  • Post-mortems shared with affected customers, with root cause and remediation.

Responsible disclosure

Found something we should know about? Email security@aviator.co with a description of the issue, steps to reproduce, and your suggested impact. We respond within one business day and credit researchers who follow coordinated disclosure.

More information