Trust
Security
Last updated: September 28, 2026. How AiM Continuity™, AiM Intelligence™, and 32AiM Technologies™ protect your work.
AI Recommends. Humans Decide.
Every AI-generated submission enters as PENDING REVIEW. No approved project, decision, task, idea, or asset record is created or modified without your explicit approval. External AI integrations cannot approve their own recommendations, delete records, change permissions, or alter authentication.
Workspace Isolation
AiM Continuity is multi-tenant. Each workspace is isolated at the server level. One customer's AI connection, projects, conversations, decisions, and recommendations can never access another customer's records. Tenant and workspace filtering is enforced server-side — never relying on the interface alone.
Authenticated Access
Protected AiM Continuity endpoints require a server-side bearer token (AIM_CONTINUITY_API_KEY). Requests without a valid token are rejected with 401 Unauthorized. The public health endpoint remains accessible but exposes no secrets, environment variables, database information, or internal configuration.
Secrets Management
API keys, bearer tokens, and credentials are stored only in secure server-side environment variables or the secrets vault. They are never placed in frontend JavaScript, source code, version control, the database as plain text, API documentation, application logs, or browser-visible variables. Secrets are never displayed after initial generation.
Controlled API Surface
External AI integrations interact only with controlled server functions and tools — never direct database queries. Read operations are limited to authenticated, scoped endpoints. Write operations create pending recommendations rather than permanent records. No external delete, approve, or admin tools are exposed.
Provider-Neutral Boundaries
Connecting ChatGPT, Claude, Gemini, Microsoft Copilot, or a custom AI does not grant that provider access to your AiM records beyond what you submit. Each request preserves its provider, integration ID, and external conversation reference for auditability. Providers operate against the same universal intake schema — no provider gets a separate or privileged database.
Rate Limiting & Validation
Protected endpoints enforce rate limiting to prevent abuse. All incoming payloads are schema-validated before processing, with request size limits and structured error handling. Malformed or oversized requests are rejected before they reach the continuity engine.
Audit Logging
The Integration Activity log records timestamp, provider, integration ID, request type, record type, status, result, and error for every API interaction. API keys, bearer tokens, OAuth secrets, and passwords are never written to logs.
Organizational Memory
Historical decisions are preserved — including superseded, changed, and rejected records — so context is never silently overwritten. When a new decision replaces an earlier one, both are retained and linked, creating durable organizational memory rather than only the latest answer.
Credential Lifecycle
Admins can create, name, rotate, and revoke integration credentials with scoped permissions (continuity.read, continuity.search, continuity.recommend, tasks.read, tasks.recommend, decisions.read, decisions.recommend). No external delete, approve, or admin permissions are issued. The complete secret is never shown again after creation.
Responsible Disclosure
If you believe you have identified a security vulnerability in AiM Continuity, AiM Intelligence, or 32AiM Technologies, please report it through the Contact page. We take reports seriously and will investigate and respond in a reasonable timeframe.