Security & trust
We hold our house to the standard we set for yours.
A managed IT provider has privileged access to every client it serves. That makes us a target, and makes our own security your business. Here’s how we manage it.
Verify it yourself
Controls you can check from the outside.
These are public and testable today. Your IT team is welcome to check them.
| Control | What we do | How to check |
|---|---|---|
| Email spoofing protection | DMARC p=reject with strict SPF and DKIM alignment, and SPF ending in -all | Any DMARC lookup tool for aeroit.com |
| HTTPS everywhere | HSTS with a two-year max-age, subdomains included | securityheaders.com, or your browser’s developer tools |
| Website security headers | A strict Content Security Policy with no inline scripts, plus nosniff, a referrer policy, a permissions policy and frame protection | securityheaders.com or Mozilla Observatory |
| No tracking | This site loads no third-party scripts, ad networks, analytics trackers or cookies | Your browser’s developer tools |
| Vulnerability disclosure | A published security.txt (RFC 9116) with a reporting contact | /.well-known/security.txt |
Inside Aero
How we protect the keys to your environment.
The controls we apply to our own team, tools and devices.
Privileged access
MFA on every staff account, phishing-resistant for administrators. Per-client credentials are held in an encrypted vault with access logging, and administrator rights are granted only when needed.
Tool security
Remote management and support tools are locked down with MFA, role-based access and audit logs.
Our own endpoints
Every Aero device runs full-disk encryption, endpoint detection and response, and automatic patching, under the same baseline we deploy for clients.
People
Background checks before hire, confidentiality agreements, regular security training, and same-day offboarding.
Vendor management
Critical vendors are reviewed for their security posture.
Incident response
A written incident response plan, kept current, including how and when we notify affected clients.
Documentation on request
Insurance certificates, policies and vendor security documentation are available to clients and prospects under NDA.
Responsible disclosure
Found a vulnerability?
We welcome reports from security researchers. Please send details through the contact listed in our security.txt. Include enough information for us to reproduce the issue, and allow reasonable time for a fix before public disclosure.
Please don’t access or modify data that isn’t yours, degrade our services, or use social engineering. We won’t pursue legal action against good-faith research that follows these guidelines.
Completing a vendor security review?
We’ll assist you in completing your vendor security questionnaire and share supporting documentation under NDA.
Start with a conversation.
Thirty minutes with a support specialist, not a salesperson. We’ll ask about your environment, tell you what we’d look at first, and say so if we’re not the right fit. No cost, no obligation, and nobody will call you seven times.