Built on a simple promise:
we don't keep your data.
Most BPO security risk comes from vendors copying customer data into their own systems. We don't. Here's how we operate and what we're certified for.
Your data never leaves your systems
Agents log into your CRM, helpdesk, and dialer. We don't replicate your customer database. When the engagement ends, access is revoked — there's nothing left on our side to leak.
Least-privilege access by default
Each agent gets the minimum scope required to do their work — a single CRM seat with a single pipeline, not admin access. We audit access weekly.
Per-agent NDAs and confidentiality clauses
Every Aurora agent signs a confidentiality agreement before they receive credentials. Confidentiality survives engagement termination for three years.
Encrypted in transit, encrypted at rest
TLS 1.3 for every connection to client systems. The few internal notes we keep (call logs, training material) are stored with at-rest encryption in providers with SOC 2 Type II.
How client data flows
Four-step model. No surprises.
Where we stand on compliance
We publish status honestly. Things in progress are flagged as such.
If something goes wrong
We notify you within 24 hours of confirming any security incident affecting your account — whether it's a misused credential, a phishing attempt on one of our agents, or any other situation that could expose your data. You'll get a written incident report within 7 days with root cause, timeline, and remediation.
Reach us at security@auroraadvertising.com for any security question, finding, or report — including responsible disclosure.
Documents available on request
For active or qualified prospects, under NDA where appropriate.
Need a deeper look?
We respond to security questionnaires within 5 business days. Ask for our DDQ pack and we'll get it to you under NDA.
Request our security package →