Due diligence · this desk
Controls we actually run
Current DD rating: NOT READY FOR PRODUCTION / NOT READY FOR CUSTOMER OR INVESTOR RELIANCE
These controls are prototype gates on this desk: headers, rate limits, buyer-scoped queries, server-side prices, an append-only audit log, a privacy request form, and an export-document checklist. They are not a penetration-test certificate, not PDPP 1321/2024 certification, not NBE licensing, and not live PSO, 3PL, or customs adapters.
AURION Global Holdings is in formation. Canonical mail [email protected]. Public host https://aurionglobalholdings.com.
DNS · aurionglobalholdings.com
https://aurionglobalholdings.com
| Do | Type | Host | Target | TTL |
|---|---|---|---|---|
| KEEP | A | @Live. | 216.24.57.16 / 216.24.57.18 | auto |
| KEEP | CNAME | wwwLive. Cloudflare flattening — public A is 104.21.2.30 / 172.67.128.165. | aurionglobalholdings.com | auto |
https://aurionglobalholdings.com — the only public URL. www and http redirect here.
Sector doors
One-label names are 301s onto this site. They are not separate companies. Aviation opens the aviation concept. Logistics has its own page in this build. The public logistics name still opens the aviation URL until this build is the origin. 5 Oct 2026. hub.aurionglobalholdings.com, www.hub.aurionglobalholdings.com, and https://aurionglobalholdings.com/hub were removed. http://aurionhub.aurionglobalholdings.com is blocked. Certificates for www.jewelry, www.agro, www.aviation, www.info-mine, www.green, www.logistics and www.globale-com were refused. Cloudflare error 1450: Advanced Certificate Manager is not on this zone. Total TLS returned the same 1450. Custom hostnames returned 1404 (no SSL for SaaS quota). The universal certificate is only *.aurionglobalholdings.com, which does not cover a second label. Those www names were not created. Apex www still 301s to https://aurionglobalholdings.com.
- jewelry.aurionglobalholdings.com → /businesses/jewelry · Jewelry301 / → /businesses/jewelrywww www.jewelry.aurionglobalholdings.com · not issued
- agro.aurionglobalholdings.com → /businesses/agro-industry · Agro-industry301 / → /businesses/agro-industrywww www.agro.aurionglobalholdings.com · not issued
- aviation.aurionglobalholdings.com → /businesses/aviation-logistics · Aviation301 / → /businesses/aviation-logisticswww www.aviation.aurionglobalholdings.com · not issued
- info-mine.aurionglobalholdings.com → /businesses/mining · Mining301 / → /businesses/miningwww www.info-mine.aurionglobalholdings.com · not issued
- green.aurionglobalholdings.com → /businesses/green-energy · Green energy301 / → /businesses/green-energywww www.green.aurionglobalholdings.com · not issued
- logistics.aurionglobalholdings.com → /businesses/logistics · LogisticsPublic DNS still 301s / to /businesses/aviation-logistics. This build’s logistics page is not the origin yet, so the live door was not moved.www www.logistics.aurionglobalholdings.com · not issued
- globale-com.aurionglobalholdings.com → /express · Global e-commerce301 / → /express. e-commerce is the same door.www www.globale-com.aurionglobalholdings.com · not issued
Mail · aurionglobalholdings.com
Inbox [email protected]. Inbound MX, SPF, DKIM, DMARC.
| Do | Type | Host | Target | Why |
|---|---|---|---|---|
| KEEP | MX | @ | route1/2/3.mx.cloudflare.net | Email Routing onboarded. |
| KEEP | TXT | @ | v=spf1 include:_spf.mx.cloudflare.net ~all | Live SPF. |
| KEEP | TXT | cf2024-1._domainkey | v=DKIM1 (RSA, published) | Live DKIM. |
| KEEP | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected] | Live. Do not add a second _dmarc. |
| Area | On this desk | Confidence |
|---|---|---|
| SSL | TLS 1.3 live 19:56 EAT 4 Oct 2026. Apex CN aurionglobalholdings.com, Google Trust Services, valid 19 Sep–18 Dec 2026. www uses a separate Let's Encrypt cert, valid 18 Sep–17 Dec 2026, then 301s to the apex. | High |
| Email security | MX route1/2/3.mx.cloudflare.net, SPF include:_spf.mx.cloudflare.net ~all, DKIM cf2024-1._domainkey, DMARC p=none. Inbound destination confirmed. No further DNS record. | High |
| Public host | Only https://aurionglobalholdings.com. http:// and www 301 to that URL. Checked 19:56 EAT 4 Oct 2026. | High |
| Business concept | Holdings + Auriexpress + AuriBulk | High |
| Live transactional marketplace | Catalog listings. Demo orders only. No live card charge. | High |
| Live payment processing | No PSO connected. Last-four theatre. | High |
| Production backend / API | This process. PGLite or Neon if configured. | High |
| Authentication / RBAC | Better Auth + buyer-scoped queries + staff gate | Medium |
| Security headers | Live 4 Oct 2026: nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy with camera and microphone off, HSTS max-age=31536000; includeSubDomains on aurionglobalholdings.com. Not a pentest. | Medium |
| Privacy (PDPP 1321/2024) | Notice + request form. Not a certification. | High |
| KYC / AML | Prototype file + AI review. Not an AML officer. | High |
| Export / customs | Checklist is on the RFQ form. Every line stays not filed. Nothing is sent to customs. | High |
| Inventory / fulfillment | Not demonstrated as live stock. | High |
| AI | Optional Grok with timeout. Human still decides. | High |
| Independent pentest | None. Do not claim one. | High |
| NBE SBB/83/2022 | Applies to banks. This desk is not a bank. Map is on Staff → Security. | High |
| GitHub Enterprise / GHES | Not installed. Personal GitHub.com account only. Public REST, not GHES. | High |
| Master registry | Name list only. Not installed. This desk does not call unnamed connectors or grant VIP roles. | High |
| Production readiness | No. | High |
What we built against the DD
- Server-side prices. The bag cannot inject cents.
- Buyer orders and vaults are scoped to the session user (BOLA/IDOR gate for those tables).
- Staff vs public: pipeline, engine, and RFQ desks stay behind the staff gate.
- Append-only audit on inquiry, demo order, KYC, privacy requests.
- Rate limits on inquiry, KYC, privacy, and Better Auth.
- Same-site fetch isolation on authenticated server functions.
- Shopper KYC stores last-four of ID only. AI recommends; a human still reads.
- Export pack: checklist only. Not Ethiopian Customs.
- Payment adapter: AURION does not hold customer money. Live capture requires a licensed Ethiopian payment-system operator under NBE. None is connected on this desk.
- Trust chips on listings: Sample / Indicative / No live payment. “Verified” is not used as marketing.
- Mining, energy and aviation stay pipeline. Logistics is an inquiry, not a carrier. No checkout on those desks.