Security & Data Protection

Aion Automation LTD · Company number 17285913 · ICO registration ZC177974 · Contact: contact@immigration.aionautomation.org

Last updated: 14 October 2026

Aion handles some of the most sensitive data a person has: passports, immigration history, health and criminal records. This page summarises how the UK service protects it, for firms and their compliance teams doing due diligence. It is a public summary of our Data Protection Impact Assessment (DPIA). The binding terms are in our Terms of Service and Data Processing Agreement, and our Privacy Notice covers how we use personal data.

1. Our role

For your clients' data, your firm is the controller and Aion is your processor under UK GDPR. We process client data only on your documented instructions, under the Data Processing Agreement in Schedule 1 of our Terms. Before each application your firm confirms its lawful basis, including the Article 9 / Schedule 1 DPA 2018 condition for special category data. Each confirmation is logged.

2. How an application flows

• Upload. Documents travel over HTTPS (TLS) into a private, encrypted storage bucket in AWS London. They are never kept on the web server.
• Extract. A single-use, isolated container reads the documents and produces a data summary. The originals are deleted as soon as extraction succeeds.
• Review. Your caseworker checks the summary before anything is filled in.
• Fill. A browser running inside the same isolated container fills in the gov.uk form. It can only visit gov.uk, and it stops at the Declaration page.
• Delete. The container and its storage are destroyed when the work ends. Remaining files are deleted within 24 hours, and the storage bucket has an automatic 2-day deletion rule as a backstop.

3. Security controls

Encryption

• All traffic is encrypted in transit (HTTPS/TLS, with HSTS).
• Stored job files are encrypted at rest (AWS S3 server-side encryption) and the bucket is private and access-restricted.

Isolation

• Every application runs in its own single-use container. Nothing is shared between applications or firms, and the container is destroyed when it finishes.
• The AI is confined to that application's own files. Its browser can only navigate to gov.uk.
• Uploaded documents are treated as data, never as instructions. The AI that reads documents has no tools, and a person reviews its output before any form is filled.
• The optional live view of a fill is encrypted and protected by a one-time token for that fill.

Access

• Sign-in is by Google, or by a single-use email link that expires after 15 minutes. We store no passwords for your Aion account.
• Session cookies are HttpOnly and Secure. Every application is checked against its owner on every request, so one firm can never open another firm's work.
• Sign-in and job creation are rate-limited. Suspending an account blocks all of its work immediately.

The gov.uk Application Password

• Held in memory only for the fill. Never written to disk, never stored in your browser, and masked out of every log and the live activity feed.
• Used exactly as entered and never changed. The gov.uk sign-in link goes to your email, which the AI cannot access.

AI provider

• We use Anthropic's Claude through its commercial API. Under those terms Anthropic does not train its models on our data.

4. Where data goes

Provider	What for	Location
Amazon Web Services	Document storage and the isolated per-application containers	United Kingdom (London)
Render	Web application hosting (no client documents stored)	EU (Frankfurt)
Anthropic	AI extraction and form filling	United States
Google	Sign-in (optional)	United States
Stripe	Payments (we never see card numbers)	United States
Resend	Account emails such as sign-in links (never client data)	United States
Crisp	Support chat	EU
Origami	Website visitor analytics: which companies visit the site (never client data)	United States

Each provider is bound by a data processing agreement. Transfers to the US rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

5. Retention

Data	Kept for
Original documents	Deleted as soon as extraction succeeds (within 24 hours if a run fails)
Extracted summary, screenshots, logs	Deleted automatically within 24 hours, or sooner on request
Application Password	Memory only, for the length of the fill
Hosting backups	Encrypted daily snapshots rotate out after about 7 days
Account and billing records (no client data)	Up to 6 years for accounting, identity redacted on request

6. DPIA summary

Our DPIA was completed in July 2026, reviewed by external counsel, and is revised whenever a provider or the architecture changes. Its overall finding is that the processing is necessary and proportionate, and residual risk is within an acceptable range.

Risk	Main mitigations	Residual risk
Unauthorised access to sensitive data	Encryption, isolated single-use containers, 24-hour deletion, per-application access checks	Low
AI error in a draft	Every output is a draft; a qualified professional reviews it; Aion never submits	Medium, falling to low with professional review
International transfers	Processing agreements and approved transfer safeguards; documents processed in the UK	Low
Exposure of the Application Password	Memory only, masked from logs, browser locked to gov.uk	Low
Applicants unaware of AI processing	Firms confirm their lawful basis and notice to clients before every application	Low
Re-identification from usage records	Usage records hold no applicant data	Very low

7. Certifications and questionnaires

Aion does not currently hold a SOC 2 or ISO 27001 certification. We are reviewing both. Our infrastructure providers (AWS, Google, Stripe and Anthropic) hold their own independent certifications, which they publish on their trust pages.

We are happy to complete security questionnaires and to share our full DPIA with firms on request. Our Data Processing Agreement also gives your firm a right to audit our compliance.

8. Incidents

If we become aware of a personal data breach affecting your firm's data, we will notify you without undue delay so you can meet your own reporting duties, and we will help you investigate and respond.

9. Contact

For security questions, questionnaires or to report a vulnerability, email contact@immigration.aionautomation.org.