Look
Runs straight away
Reading status and logs never changes anything, so it never has to wait.
Security
How Aria secures your server
Aria hardens every server before your app runs on it, then checks the result. If a critical check fails, Aria holds the server instead of launching on it.
- Hardenedbefore your app runs
- Checkedand the result recorded
- Heldif a critical check fails
Hardening
What is hardened on the server?
Six layers, set up the same way on every server, before your app arrives.
Login to the server (SSH)
- Password login is off.
- Root can sign in with a key only, with three tries, and with no X11 or agent forwarding.
- Only Aria’s own control network can reach SSH at all.
- Aria pins each server’s SSH identity, so it can tell if a server is not the one it set up.
Firewall
- By default, incoming connections are refused except web traffic (ports 80 and 443) and Aria’s own control connection.
Containers
- A port that an app publishes cannot get around the firewall.
- Containers cannot reach the cloud provider’s metadata address.
Updates
- Security updates install themselves.
Operating system
- Network and kernel settings are tightened on real machines, for example against forged addresses, redirects and leaks of kernel addresses.
Outgoing mail
- Your server stays off spam blocklists, so your mail keeps landing.
- Apps send through Aria Mail, or a mail provider you connect.
The firewall
What gets past the wall?
Web traffic and Aria’s own control connection. Everything else stops here.
- Web traffic on ports 80 and 443Let through
- Aria’s own control connectionLet through
- SSH from anywhere elseRefused
- Any other incoming connectionRefused
- A port an app publishesRefused
- A container reaching for the metadata addressRefused
After setup
How does Aria check the result?
After setup, Aria runs hardening checks on the server and records the result. It covers ten things.
- Passed
- Your app launches.
- A critical check fails
- Aria holds the server and tells you, instead of launching your app on it.
The checks cover the server. Your application code is yours to review.
- Security updates
- The SSH rules
- The firewall
- Which ports are listening
- Docker’s settings
- Time sync
- Logging
- Brute-force protection
- File permissions
- The server’s host keys
Encryption
How are my secrets stored?
Secrets are encrypted at rest with AES-256-GCM, with keys that can be rotated.
- Values you enter are shown once and are never given to a coding agent.
- Results and errors that go back to an agent have secrets masked, even inside logs.
- Your Aria account password is stored hashed with Argon2id.
- You can turn on two-factor authentication.
Look, Change, Delete
What can an AI agent do?
Aria enforces the limits on its own servers, not in a prompt. The same rules apply to Aria AI and to every agent over MCP.
Change
Waits for you, or runs if you allow it
With a read key, every change waits for your approval. With an operate key, routine deploys run straight away.
Delete
You approve, and you type the name
Deleting needs your approval, and in the app or on the website you confirm by typing the name.
| What the agent asks for | Read key | Operate key |
|---|---|---|
| Reading status and logs | Runs straight away | Runs straight away |
| Routine deploys | Waits for you | Runs straight away |
| Environment variables, launches, DNS records and GitHub pushes | Waits for you | Waits for you |
| Anything destructive | Waits for you | Waits for you |
- An agent key reaches one app
- Every call is recorded in Activity
- You can revoke a key at any time
- How the safety levels work
Backups
What are my backups?
Postgres, Supabase and your volumes are backed up every night. Backups are encrypted on your server before they leave it, stored off the server and kept for 30 days by default.
- You can choose your own schedule, retention and encryption key.
- Redis is a cache and is not restored.
- Backups in the docs
Privacy policyHow personal data is handled.SubprocessorsWho helps Aria handle personal data.
Aria Cloud is made by Inverta Group Limited, a company registered in England and Wales. This page lists what Aria does today. It is not a certificate or an audit report.
Start
A server that’s hardened before you arrive.
Aria sets it up, checks it and keeps it patched. You bring the app.