Security, up front.

Everything your IT and compliance teams will ask, answered before they have to.

Where Aureate runs

We host a dedicated, single-institution deployment for you. Your data is never mixed with another school's. Data stays in the United States.

Aureate runs inside your institution's own cloud account, under your controls.

Aureate and its AI model run on your own hardware. It can run with no outside internet connection at all, so donor data never leaves your network.

You own your data. We never sell it or share it.
Aureate's core model is never trained on donor data — yours or anyone else's.
What Aureate learns about how your institution works stays inside your deployment and is never used for another school.
When your contract ends, we delete your data within 30 days and confirm it in writing.

Aureate runs on a US-built, open-source small language model, specialized for Advancement and trained on thousands of synthetic advancement examples, never on real donor data.
It runs inside your deployment. A larger frontier AI model, from a provider you approve, can be connected for reasoning-heavy tasks, but it isn't needed for Aureate's core work.
It gets better with use. Your team's approved corrections and decisions add to what Aureate knows about your institution, saved as reviewed versions inside your deployment.
The AI reads a policy once, a person confirms what it understood, and Aureate follows that approved version. It doesn't reinterpret your policies on every run.

No live connection to your CRM or finance system. You upload exports; Aureate returns import-ready files.
Aureate cannot change records in your systems. Your staff decide what to import.

We don't connect to your tools, by design. You import exports, Aureate suggests changes for your team to approve, and you export the results as import or overwrite files your systems already accept.
Nothing goes live without approval from authorized staff.
Every rule change is saved as a new version with who, when and why.
Every workflow run is recorded, so you always have an audit trail.

Item	Status
Data Processing Agreement (DPA)	Available on request
FERPA (colleges & universities)	Aureate acts as a school official under your direction
Breach notification	Within 72 hours
HECVAT	Security questionnaire answers available on request
SOC 2	Not yet certified — our security packet is available on request
Encryption in transit and at rest	Details in our security packet
Single sign-on (SSO)	Planned
Subprocessors	List available on request

Need our security packet? Request it →