Security & your data

Every brand in Aida has its own Brand Brain and its own member list, and access is enforced per brand at the application layer. Your Brand Brain is used only to generate content for your brand — it is never blended into a shared profile or used for anyone else's content.

For agencies this separation is the point: each client brand is its own Brand Brain with its own access. Clients see their own brand and nothing else, and no client's knowledge ever leaks into another client's output.

Aida does not train or fine-tune any shared AI model on customer data. The Brand Brain works by giving the AI your brand's context at the moment of creation — a private knowledge base, not a trained model. When you correct or approve something, that learning is stored in your Brand Brain and benefits your brand only.

The models themselves (Google Gemini, Imagen and Veo, plus partner models) run through Google Cloud Vertex AI under Google Cloud's enterprise terms, which do not permit customer inputs or outputs to be used to train their foundation models.

A Brand Brain is built from your public website, the assets and guidelines you upload, the channels you connect (with permissions you approve at connection time), and your own edits and approvals inside Aida.

Two things are worth separating. Aida's public brand previews — the analysis pages anyone can request for a website — are built only from publicly available web content. Your private Brand Brain — uploads, strategy, unpublished drafts, connected account data — never appears on any public page.

Aida runs entirely on Google Cloud. The primary database lives in the European Union (Netherlands, europe-west4); uploaded media files are stored in Google Cloud Storage in the United States; AI processing runs in Google Cloud regions appropriate to each model.

All data is encrypted in transit (TLS) and at rest (AES-256, managed by Google Cloud). The access tokens for your connected social accounts get an extra layer: they are encrypted at the application level with AES-256-GCM before being stored, with keys held in Google Secret Manager — so even direct database access would not expose your social accounts.

Sign-in uses Firebase Authentication (Google sign-in or email and password). Payments are handled by Stripe; your card details never touch Aida's servers.

This is a hard rule in how Aida is built, not a setting: nothing is published to your channels without your explicit approval. Scheduling only queues posts you have already approved. There is no fully autonomous posting mode — deliberately.

You can delete a brand — its Brand Brain, content and history — from inside the app at any time. To delete your entire account and its data, email hello@theaida.ai and we will action it. Connected social accounts can be disconnected from Aida at any time, or revoked from the platform's own settings.

Aida's infrastructure — Google Cloud and Firebase — is certified to ISO 27001 and SOC 1, 2 and 3. Aida itself is a young company and has not yet completed its own SOC 2 audit; when we have, the report will be linked from this page. We would rather tell you that plainly than imply otherwise with a wall of badges.

We operate from the European Economic Area and handle personal data under GDPR. If your organisation needs a data processing agreement, email hello@theaida.ai and we will put one in place.