The short version. Astrolium encrypts every byte of your data at rest with AES-256 and in transit with TLS 1.3. Passwords are hashed with Argon2id and never stored in cleartext. Two factor authentication is on every tier including free. Servers are in Frankfurt with a Dublin replica. We do not train AI models on your charts. See the privacy policy for the data we collect, the terms of service for the legal framing, and the status page for live uptime.
1. Encryption
- At rest — All client data is encrypted at the volume level with AES-256. Database backups are encrypted independently with separate keys, rotated every 90 days.
- In transit — Every connection to Astrolium uses TLS 1.3 with HSTS preload. We do not accept TLS 1.0 or 1.1, and TLS 1.2 is rejected for new sessions as of January 2026.
- Backups — Daily encrypted backups, retained for 30 days, stored in a separate region (Dublin) from the primary (Frankfurt). After 30 days they are permanently and verifiably deleted.
2. Authentication
- Passwords are hashed with Argon2id, configured at the OWASP-recommended cost (memory: 64 MiB, iterations: 3, parallelism: 4). We never see your password in cleartext, and neither does our database. A leaked dump of the user table contains hashes only.
- Two factor authentication is available on every tier — Free, Pro, Adept, and Master. We support TOTP apps (Authy, 1Password, Google Authenticator) and hardware security keys (WebAuthn).
- Session cookies are HttpOnly, Secure, SameSite=Lax, and rotate on every privilege change. Sessions expire after 30 days of inactivity.
- SSO (Google Workspace, Microsoft 365, Okta) is available on the Master tier.
3. Infrastructure
- The marketing frontend and edge runtime are hosted on Vercel. The product backend and all client data run on Hetzner Cloud in the EU, in 2 regions (Frankfurt primary, Dublin replica).
- The application is fronted by Cloudflare for DDoS protection and CDN caching of static assets only — no request bodies are stored at Cloudflare's edge.
- The ephemeris service runs in 1 vCPU containers, 2 replicas per region. See the ephemeris service post for the engineering details.
- We target 99.9% uptime; April 2026 actuals are 99.96%. Real time status lives at the status page.
4. Compliance
- GDPR — Astrolium applies GDPR equivalent protections globally because it's simpler and because we think it's right. Read the privacy policy for your rights and how to exercise them.
- SOC 2 Type II — Audit in flight, target attestation date Q3 2026. Updates on the roadmap.
- Penetration testing — Annual third party penetration test. The 2026 report is summarised below; the full report is available under NDA on request to enterprise customers.
- Sub-processors — named sub-processors only: Vercel (frontend hosting), Hetzner (backend and data hosting, EU), Stripe (payments), Postmark (transactional email), OpenRouter (AI inference, Google Gemini models), and Cloudflare (CDN/DNS). We don't add a sub-processor without updating the privacy policy first.
5. Reporting vulnerabilities
Found a security issue? Email [email protected]. We respond within 24 hours, acknowledge within 72 hours, and aim to ship fixes within 7 days for high severity issues.
We don't run a bug bounty program and offer no monetary rewards for reports. We will not pursue legal action against researchers who report in good faith and follow standard responsible disclosure.
6. Data ownership and portability
You own your data. From your account settings:
- Export your whole workspace as one JSON archive. It spans 14 data domains: profile, clients, sessions, chart records, tags, folders and their assignments, saved configs, Knowledge Base, Report Studio templates and documents, brand profiles, intake forms and submissions, saved horary charts, AI conversations, and transit-alert rules. We characterise it as a GDPR Article 15 right-of-access export, which is broader than the Article 20 portability right: it includes material we derived, not only what you typed in. A few secondary domains are not in the archive yet, and the export screen names them rather than leaving you to discover the gap.
- Export individual charts as PDF or PNG with metadata
- Delete your account. Data is purged from the primary store within 7 days and from backups within 60, on the schedule in the privacy policy. Deletion runs as an ordered sequence that fails closed and can be retried: it confirms the Stripe subscription has ended, detaches any custom share-link domain, revokes Google Calendar and Drive grants, clears stored files and your BYOK secrets, and only then removes the account identity.
- Correct any data Astrolium holds about you
Astrolium does not lock you in. The export format is documented and human readable.
7. AI and machine learning
Astrolium does not train AI models on your charts, your client roster, your notes, or your interpretations. The AI-assisted features run on Google Gemini models accessed through OpenRouter, which only receives the chart you're actively working on, for inference. Your chart data is never used to train any model. Inference is stateless at the provider: no logging, no caching of inputs, no training.
Memory is ours to hold and yours to delete. Sky, the in-product assistant, keeps two separate memories: Client Memory, the facts it has learned about a given client, and Practice Memory, your own methods and workflow preferences. Both are stored by Astrolium, not only in a provider's context window. You choose whether Sky saves automatically, asks first, or never saves at all, and you can read, edit, or delete any entry from Settings and from the client record. Turning memory off stops reading and writing; existing entries stay until you remove them.
Adept and Master can run AI on a provider key of your own, from OpenAI, Anthropic, or OpenRouter. Keys are held in an encrypted secrets store (Supabase Vault), never returned to the browser, and removed when you delete your account.
Guard-rails you cannot be talked out of. Some limits on what the assistant will say are enforced server-side on every request, and workspace settings can add care but never remove it:
- It does not predict a person's death or any certain, inevitable fatal outcome, and questions aimed at one ("will I die") get the same answer.
- Anything touching suicide or self-harm gets a supportive response that points to urgent local or emergency help, and the predictive reading stops there.
- Medical, legal, financial, pregnancy, and fertility themes stay available but are framed explicitly as astrological judgment, never as clinical, legal, or financial instruction.
- It uses only the client data you supplied. It does not invent, request, or surface a name, a contact detail, or a fact you never gave it.
Two further refusals are published inside the app as planned behaviour and are not enforced yet: reading the chart of a third party who has not consented, and reading a named public figure's chart. The app labels them that way, and so do we. This page will change when they ship.
If you work through your browser's built-in translator on the English or Russian interface, the workspace holds up: we hardened the app against the DOM rewriting that in-browser translators inject, and we test for it.
8. Past incidents
The status page lists every incident in the last 90 days with a postmortem for anything over 30 minutes. As of the date on this page, no incident has involved unauthorized access to user data. If one ever does, we will publish the postmortem here and email every affected user within 72 hours of discovery — well inside the GDPR 72 hour breach notification window.
For our broader engineering posture see the ephemeris service post. For the legal framework see privacy and terms. For uptime see status. For everything else, [email protected].