Security
Security is a design decision, not a listed feature
These are the mechanisms behind AetherNet — stated plainly, the way our engineers built them.
Isolation
Workspaces never see each other
- Every record belongs to exactly one operator workspace, and the server enforces it on every query — not just in the interface.
- Cross-workspace access returns a plain “not found”; existence is never leaked.
- Platform-level operator functions are separate permissions, held only by the platform owner role, and every use is audited.
Secrets & credentials
Encrypted where they live
- Router credentials, payment secrets and 2FA keys are encrypted at rest with AES-256-GCM.
- Passwords are hashed with Argon2id — never stored, never logged.
- Secrets are masked in every API response and provisioning plan; redaction happens before storage, not after.
- Logs are sanitised — tokens and passwords never appear in diagnostics.
People
Accounts that behave
- Eleven built-in roles and custom roles; permissions are enforced server-side on every endpoint.
- Two-factor authentication with recovery codes; first-login password changes for new staff.
- Login lockouts and rate limiting on public endpoints.
- Per-device session list with revoke-all for every staff account.
Routers
An access model the network can trust
- Enrollment is router-initiated with single-use, expiring tokens — nothing on your side listens for the internet.
- The management agent runs as a dedicated least-privilege RouterOS user, created for AetherNet alone.
- Provisioning only touches what a reviewed plan lists, records what it created, and can roll back.
- Disruptive changes require explicit confirmation with a human-readable preview.
Audit
Write it down, always
Every sensitive action — sign-ins, staff changes, customer blocks, policy updates — lands in an audit trail with actor, time and result.
Trail you can read
Plain action names, affected record and who did it — searchable per workspace.
Platform actions recorded
Owner-level operations are audited in the affected workspace’s own trail.
Honest error handling
Errors never leak stack traces or secrets to clients.
No certifications are listed here because none have been earned yet — what you read above are working mechanisms you can verify with us directly.
Ask us the hard questions
Bring your security requirements — we’ll answer with specifics, not adjectives.