Security
How Aimiru protects what it holds for you.
- Agent keys and approval links are stored only as fingerprints. Aimiru cannot read them back.
- Provider keys and personal details in the Vault are encrypted with a key for your space, which is itself encrypted with a key kept outside the database.
- Every action lands in your record, and each entry is linked to the one before it. You can check the whole chain in your browser from Privacy and data.
- When Aimiru cannot be reached, agents Aimiru holds stop paying, sending, sharing, booking, deleting and signing in until it is back. Agents that only check with Aimiru are asked to wait.
- Approval links work once and expire with the request.
Anyone can check entries from your record without an account. In Activity, Get a statement for a day or Share proof of one entry, then check it here: Check a proof
What Aimiru cannot see, agent by agentMade by Rohit Gajaraj
Check your record
Every day after midnight UTC, Aimiru publishes one fingerprint that covers every record's last entry that day. Your export lists your own; anyone can check it is part of the one published here.
Since proof sharing, each day also has a proof fingerprint: a proof of one entry from your Record checks against it at /check, showing nothing else of your Record.
Each day's fingerprints are also stamped by DigiCert, Sigstore and OpenTimestamps, outside Aimiru, so nobody has to take Aimiru's word that a fingerprint is as it was. A proof checked with Check a proof shows the stamps of its days.
Reading the published fingerprints.