Security & compliance

An RMM can reach every computer you manage, so it has to be the most careful software you run. This page explains how we protect AadeeRMM, where your data lives, and where we stand on the frameworks your customers ask about. We are happy to complete your security questionnaire: email aadeermm@aadeeinfosys.com.

1. Compliance at a glance
2. How we protect the Service
3. Hosting and resilience
4. ISO 27001 and NIST CSF mapping
5. Healthcare organisations (HIPAA)
6. Incident response
7. Reporting a vulnerability
8. Documents

1. Compliance at a glance

We tell you exactly where we stand. We do not claim certifications we do not hold.

2. How we protect the Service

Identity and access

• Two-factor authentication is required for every technician. Sign-in with Microsoft or Google is also available.
• Passwords are checked against known breached passwords using the k-anonymity method, so the password itself never leaves our server.
• Roles go from Owner to read-only, and technicians see only the customers they are assigned.
• Each subscriber's data is kept separate from every other subscriber's.

Encryption

• All traffic, including every agent connection, uses TLS with HTTP Strict Transport Security.
• Secrets are encrypted at rest with keys held only on our servers. This covers two-factor keys, managed administrator passwords, network device logins, API, payment and storage keys, Microsoft tokens and device backup keys.
• Session recordings are encrypted. Device backups are encrypted on the computer before upload.
• Database replication between our servers runs only inside an encrypted tunnel.

The user stays in control

• Permission prompts for sessions, chats and calls, a visible notice with the engineer's name, and an End button only the user can press.
• Voice calls are never recorded. Terminal output is not stored. Transferred files are deleted from our servers once delivered.

Accountability

• A tamper-evident audit log records sessions, terminal commands, file transfers, chat lines and changes to settings.

Secure software

• The agent and every update are code-signed by Aadee Infosys Ltd, and updates are checked by signature and checksum before they install.
• The agent only connects out over HTTPS. Nothing listens on your devices.
• We keep dependencies up to date and prioritise security fixes.

Infrastructure

• The database is never reachable from the internet. Application services run in containers as unprivileged users, and only the web proxy accepts connections.
• Strict security headers are set: Content Security Policy, HSTS, and protection against framing and content-type sniffing.
• AI features (ticket summaries and suggested replies) run on our own servers. Your data is not sent to outside AI providers or used to train models.

3. Hosting and resilience

• Location: India. A primary server runs in a commercial data centre, and a standby server runs at a second location.
• Automatic failover: the standby keeps a continuously replicated copy of the database. If the primary goes down, the standby takes over by itself within minutes. Checks from both our own servers and Cloudflare must agree before it does. A generation number stops an old server from ever serving out-of-date data.
• Backups: daily backups of the database, encryption keys and files, kept for 14 days.
• Direct connections: our DNS provider sends visitors straight to the live server. No third party sits in the middle of your traffic.

4. ISO/IEC 27001:2022 and NIST CSF 2.0 mapping

This table shows where our main controls sit in each framework. It is a self-assessment, not a certification or an auditor's opinion.

5. Healthcare organisations (HIPAA)

AadeeRMM is not designed to store protected health information (PHI), and we do not currently sign Business Associate Agreements. Healthcare organisations, and MSPs serving them, can still use it to monitor, patch and support computers if they keep PHI out of the Service:

• Don't record sessions on computers that show patient information. Recording is off unless a technician starts it.
• Keep patient details out of tickets, attachments, chat messages, scripts, custom fields and file transfers.
• Use remote control for technical work only, and close patient records before connecting.
• Make sure your own HIPAA risk analysis covers the use of remote support tools.

6. Incident response

Automated checks watch the Service around the clock, both from our servers and from outside. When something goes wrong, we investigate, contain it and fix the cause. If a personal data breach affects your data, we notify you within 48 hours of becoming aware of it. We give you the information you need for your own obligations and keep you updated until it is resolved.

7. Reporting a vulnerability

If you find a security issue in AadeeRMM, please email aadeermm@aadeeinfosys.com with "Security report" in the subject. Include enough detail for us to reproduce it. We acknowledge reports within 3 working days and keep you informed until the issue is fixed.

We will not take legal action against research done in good faith that:

• avoids privacy violations, data destruction and service disruption;
• uses only your own accounts and test devices;
• does not use social engineering or physical attacks;
• gives us reasonable time to fix the issue before anything is disclosed.

Our contact details are also published in security.txt.

8. Documents

• Terms of Service
• Privacy Policy, including what we store and for how long
• Data Processing Addendum, with the transfer clauses, security measures and sub-processors
• Security questionnaires (CAIQ, SIG Lite or your own): email aadeermm@aadeeinfosys.com