Most vendor security pages are written to end a conversation. This one is written to let you skip a questionnaire: where the data physically sits, what protects it, and — the part usually left out — the certifications we have not got.
Asli One's self-serve platforms run on Amazon Web Services in Frankfurt, Germany (eu-central-1), so data for Aslio and QRasli is hosted inside the European Union. Traffic is encrypted with TLS. The five industry ERPs are dedicated single-tenant deployments, which means the customer chooses the hosting region. Asli One holds no SOC 2, ISO 27001 or HIPAA certification and does not claim one.
Data residency is the first question every buyer outside India asks, so it goes first.
| What | Hosted in | Who controls it |
|---|---|---|
| Aslio (messaging API) application and data | AWS Frankfurt, Germany — eu-central-1 | Asli One |
| QRasli (QR codes) application and data | AWS Frankfurt, Germany — eu-central-1 | Asli One |
| Outbound email delivery | AWS Simple Email Service, Mumbai, India (ap-south-1) | Asli One |
| Asli Dine, Asli Campus, Asli Lex, Asli ERP, Asli Pharma ERP | Wherever you require — each is a dedicated deployment | You, by agreement |
If you need an EU-only or GCC-only path end to end, including message delivery, say so before you sign — for a dedicated deployment it is a configuration decision, and for the self-serve products it is a conversation we would rather have up front than in an audit.
Only things that are true today. Nothing on this list is a roadmap item.
TLS on every connection to every application and API. No plaintext endpoint is offered.
The five ERPs are separate deployments with separate databases. Another customer's incident is not your incident, because there is no shared instance.
Granular roles inside the products — Asli Dine alone ships twelve distinct roles, so floor staff cannot see what the owner sees.
Aslio sends on your verified domain with your DKIM, so your mail reputation stays yours and is not pooled with other senders.
Bounces and complaints are suppressed automatically, which is a deliverability control and a recipient-privacy control at the same time.
Your data is exportable. Leaving is a supported operation, not a support ticket to be slow-walked.
For customers in the European Union and the United Kingdom, Asli One acts as a data processor and the customer as controller. A data processing agreement is available on request before you sign, including the standard contractual clauses for transfers out of the EEA where any part of the service touches India. Because the self-serve platforms are hosted in Frankfurt, the primary storage location is already inside the EU.
For customers in India, the Digital Personal Data Protection Act, 2023 applies. Asli One is a data fiduciary for its own customer records and a processor for customer-uploaded data, and contracts on that basis.
For customers in the GCC, dedicated deployments can be hosted in-region to satisfy local data residency expectations. Our Pharma ERP customer in the UAE is a live example of that arrangement.
Ask for the DPA, a security questionnaire response, or a written statement of any of the above at info@asli.one. You will get a real document, not a link to this page.
A security page that lists only strengths is not information. Here is the other half, stated plainly so you can rule us in or out without wasting a procurement cycle.
These are gaps, not positions. Several are on the plan. But you should decide based on what exists today, which is what this page is for.
The self-serve platforms — Aslio and QRasli — run on Amazon Web Services in Frankfurt, Germany (eu-central-1), inside the European Union. Outbound email is delivered through AWS Simple Email Service in Mumbai, India. The five industry ERPs are dedicated deployments hosted wherever the customer requires.
Asli One acts as a data processor for EU and UK customers and will sign a data processing agreement, available on request, including standard contractual clauses where data moves outside the EEA. Primary storage for the self-serve products is already in Frankfurt.
No. Asli One holds no SOC 2 report and no ISO 27001 certification, and does not claim either. If your procurement requires one, we will not pass it today and would rather tell you now.
For the five industry ERPs, yes — each is a dedicated single-tenant deployment, so the hosting region is a decision you make. For Aslio and QRasli the region is Frankfurt today; a region-specific arrangement is a conversation, not a setting.
On the ERPs, completely — separate deployment, separate database, no shared instance. On the self-serve platforms, data is logically separated per account in the ordinary way of a multi-tenant application.
Yes. Data export is supported. We would rather be chosen again than retained by making the exit hard.
Write to info@asli.one with the details. Please do not post an unpatched issue publicly before we have had a chance to respond.