You are handing us your audience, your money path and other people’s travel plans.
So this page states what Audonomics actually does — where the enforcement lives, what the database refuses to allow, what an AI agent is permitted to do on its own, and which parts of our compliance position are not finished yet.
Hiding a button is not a security control.
Every mutation is checked server-side against a permission key before it runs. The interface hides what a role cannot do as a courtesy; the assertion in the request path is the actual control, and it does not care what the client sent.
- OwnerEverything, including billing, team, contract approval and AI action approval.
- ManagerRuns experiences end to end. Cannot change billing or remove the owner.
- Team memberOperational access to the work assigned. No audience export, no refunds.
- VendorSees only the RFQs, quotes and contracts addressed to them. Never the audience.
- Partner / SponsorSees only their own sponsorship deal and its deliverables.
- FanSees their own orders, tickets, travel and community access. Nothing else.
- Platform adminSupport access, fully audit-logged, scoped and time-bound.
- Permissions are
resource:verbkeys — coarse enough to reason about, fine enough that a vendor can never reach the audience - Every record lives under an organisation, and every query is scoped to it. Multiple organisations under one account stay isolated
- Session tokens are random 256-bit values; only a SHA-256 hash is stored, so a database read cannot impersonate a user
- Cookies are httpOnly, SameSite=Lax and Secure in production. Sessions expire after 30 days and can be revoked server-side
- Passwords are hashed with bcrypt at cost 11 and never logged
- Every mutation a human or an agent can make is written to an append-only audit log with the actor, the target and the change
The rules that matter are in the database, not the app.
Application-level checks lose races. When two people buy the last seat at the same instant, the thing that decides who gets it should be the database, not the order in which two requests happened to reach a web server.
These constraints are declared in SQL and enforced on every write, including writes made by us.
- packages_no_oversellsold ≥ 0 and held ≥ 0 and sold + held ≤ quantity
- orders_refund_not_over_paidamount_refunded ≥ 0 and amount_refunded ≤ amount_paid
- orders_totals_nonnegsubtotal, total, amount_paid and discount_amount are never negative
- order_items_qty_positivequantity > 0
- discounts_within_limitredemptions ≤ max_redemptions
- lodging_no_overassignassigned ≥ 0 and assigned ≤ rooms
- transport_no_overassignassigned ≥ 0 and assigned ≤ seats
- taskdep_not_selfa task can never depend on itself
Constraint names as they exist in the schema. Reproduced, not paraphrased.
Money is never a float
Every amount is an integer in minor units, end to end. Installment schedules always re-sum to the order total; no cent is created or lost in a split.
Behaviour is append-only
Audience events are never edited in place. Scores and segments are recomputed from the log, so a wrong weight is fixable rather than baked in.
Card data never reaches us
Payment details go directly to the payment processor. Audonomics stores the payment state and the last four digits — nothing that could be replayed.
What an agent can do without asking: nothing that costs you.
The AI Opportunity Architect reads your data and drafts work. It can produce a concept, build a model, write a campaign and assemble a vendor brief. It cannot send, sign, charge, refund or publish.
- Every proposed side effect becomes a row in an approval queue with its payload, its summary, its risk notes and the role required to approve it
- Nothing creating a financial, contractual, legal or external commitment executes without an approval on that row
- Approvals are recorded with the approver and the timestamp, and are audit-logged like any other mutation
- Every conversation turn is persisted, so a decision made months ago can still be traced back to the reasoning behind it
- Model output is labelled AI, which caps any claim built on it at 0.50 confidence
- ObservedRecorded directly from your data. Not an estimate.0.95
- CalculatedArithmetic on observed data. Deterministic and reproducible.0.90
- ExternalSourced from a third party. Accuracy depends on that source.0.75
- ModeledAn estimate from assumptions you can inspect and change.0.60
- AIGenerated by a language model. Judgement, not measurement.0.50
Provenance is a security control as much as an honesty one: it stops a generated number from being laundered into a fact by passing through three screens.
It is your audience. We are a processor.
You are the controller of the audience data you bring to Audonomics. We process it to run the platform, and for nothing else.
We do not sell or share your audience
Your member records are not pooled, resold, syndicated, or used to build a cross-customer product. There is no data network effect in our business model, deliberately.
We do not train models on your data
Your audience, orders and financials are not used to train or fine-tune any model, ours or a vendor's. Agent requests run under zero-retention terms with our model provider.
Export is a right, not a feature request
Every record you put in comes out in full, at any time, on every tier. Cancellation does not hold your data hostage.
Deletion means deletion
Delete a member and the identities, events and segment memberships cascade. Records we must retain for tax or legal reasons are named in the data processing agreement.
Encryption
TLS in transit. Encryption at rest on the database and on backups. Secrets are held outside the codebase and rotated.
Subprocessors
Hosting, database, payments, email and the model provider. The current list, with what each one can see, is published in the data processing agreement.
Where we actually are.
A security page that implies certifications it does not hold is the same failure mode as a dashboard that shows an estimate as a fact. So here is the position, stated plainly and dated.
- Encryption in transit and at restIn place
- Role-based access control on every mutationIn place
- Append-only audit logIn place
- Data processing agreementAvailable on Managed
- GDPR and UK GDPR: access, export, deletionIn place
- SSO / SAMLManaged tier, in build
- SOC 2 Type IINot yet — no report exists
- Independent penetration testScheduled, not yet performed
- PCI scopeOut of scope — we never touch card data
We will publish the SOC 2 report date when we have one, and the penetration test summary when it is done. Until then this page says so, because writing “enterprise-grade security” instead would be exactly the kind of unlabelled claim the rest of the product exists to prevent.
Tell us and we will fix it.
Email security@audonomics.com. We acknowledge within one business day, we do not pursue researchers acting in good faith, and we credit anyone who wants credit. If you find something that lets one organisation read another’s data, treat it as urgent and say so in the subject line.
Read the guarantees before you trust us with an audience.
Everything above is checkable — the constraints, the roles and the approval gate are all in the product from the first day you use it.