Our Security Commitment
ME24 Limited (“we”, “us”, “our”) takes the security of your data seriously. This document provides a summary of the key security measures we implement to protect personal data processed through the Areela platform. For detailed information, please refer to the Subscription Services Agreement (in particular Clause 8 (Security)), the Data Processing Addendum at Schedule 2, the AI Transparency and Use Policy (Document 5), the Data Retention Policy (Document 7), and the International Data Transfer Addenda (Document 9). OpenAI maintains security measures as set forth in its Services Agreement and makes available audit reports conducted by independent auditors. OpenAI’s security measures are available at cdn.openai.com/osa/security-measures.pdf. ME24 Limited may request copies of OpenAI’s most recent audit reports once per year.
Key Technical Measures
Our wider security programme includes vulnerability management, penetration testing, documented incident response, business continuity and disaster recovery planning, employee security awareness training, and physical security controls applied by our hosting and service providers. Specific recovery targets and certain environment-specific controls remain subject to confirmation where noted below.
Measure | Details |
|---|---|
Encryption in transit | All data transmitted to and from the Platform is encrypted using TLS 1.2 or higher |
Encryption at rest | All stored data, including databases and backups, is encrypted using AES-256 or equivalent |
Authentication | Email One-Time Password (OTP): no persistent passwords stored; biometric authentication (fingerprint/Face ID) supported on mobile |
Access controls | Role-based access control with least-privilege principle; regular access reviews |
Monitoring | Sentry and Inspector provide monitoring and may receive user data in diagnostic events or traces; Laravel application logs rotate daily |
Backups | Encrypted backups on short rolling period; overwritten on rotation |
AI security | OpenAI OpCo, LLC: ZDR applies to eligible API endpoints; no logging for abuse monitoring or human review and no retention beyond response generation for covered content; image/file inputs may be retained for automated Safety Classification; no model training under the OpenAI Enterprise Agreement and Modified Retention Amendment. |
Hosting and Infrastructure
The Areela platform is hosted on Laravel Cloud LLC in the EU West (London, United Kingdom) region. Production is separated from staging and test by a production VPN boundary, and no customer data is used in non-production. A global edge network provides DDoS protection and CDN edge caching. Autoscaling compute with scale-to-zero capability supports the production database, cache, WebSockets and private storage bucket.
Certifications and Compliance
a) UK GDPR and Data Protection Act 2018: Compliant. ICO registration ZC069669.
b) SOC 2 Trust Services Criteria: Framework alignment in progress.
Incident Notification
In the event of a personal data breach:
a) We will notify the Information Commissioner’s Office within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of data subjects, in accordance with Article 33 of the UK GDPR.
b) We will notify affected data subjects without undue delay where a breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 of the UK GDPR.
c) We will notify affected customers (data controllers) without undue delay upon becoming aware of a personal data breach affecting their data, as required by the Data Processing Addendum at Schedule 2 of the Subscription Services Agreement.
Contact
For security-related enquiries, please contact us at support@areela.com.
Regular Review and Improvement
Our security measures, policies, and procedures are reviewed at least annually and updated as necessary to address evolving threats, regulatory changes, and improvements to industry best practices. We are committed to the continuous improvement of our security posture.
Changes to This Policy
We may update this Policy from time to time. The most current version will be available at areela.com/legal. Where we make material changes, we will provide at least 30 days’ advance notice by: (a) displaying a prominent notice on the Platform; (b) sending an email to the address associated with your account; or (c) both. Material changes include changes that affect: your rights and obligations; how your personal data is processed; the scope of services or features available to you; or any other matter that could reasonably be expected to affect your use of the Platform.