Due diligence · this desk
Controls we actually run
Current DD rating: NOT READY FOR PRODUCTION / NOT READY FOR CUSTOMER OR INVESTOR RELIANCE
These controls are prototype gates on this desk: headers, rate limits, buyer-scoped queries, server-side prices, an append-only audit log, a privacy request form, and an export-document checklist. They are not a penetration-test certificate, not PDPP 1321/2024 certification, not NBE licensing, and not live PSO, 3PL, or customs adapters.
AURION Global Holdings is in formation. Canonical mail [email protected]. Declared host aurionglobal.site.
Grok DNS · aurionglobal.site
Protected LiteSpeed A 66.29.148.167 cannot be deleted in DNS. Disconnect Shared Hosting: Spaceship → Hosting Manager or Connection Manager → aurionglobal.site. Then ⋮ → Remove connection / Disconnect domain. Confirm Remove connection. Keep only 64.239.109.1. Recheck 2026-09-17T01:03+03:00.
Domain registration, Spaceship nameservers, Grok A 64.239.109.1, www CNAME, Spacemail MX/SPF/DKIM/SRV.
Do not cancel the domain. Do not change nameservers. Do not disconnect Spacemail — MX is already live.
| Do | Type | Host | Target | TTL |
|---|---|---|---|---|
| DISCONNECT HOSTING | A | @ | 66.29.148.167 | — |
| KEEP | A | @Currently missing from public DNS. Must be the ONLY A on @ | 64.239.109.1 | 1 hour |
| KEEP | CNAME | wwwAlready aliases to the apex | aurionglobal.site | 1 hour |
ADD A @ 64.239.109.1. Disconnect Shared Hosting so 66.29.148.167 drops. Then this Grok project → Publish → Add custom domain aurionglobal.site. Until attach, Host header 404s. Do not disconnect Spacemail.
Mail · SPF DKIM DMARC
Provider Spacemail. Checked 2026-09-17T00:41+03:00. Official map: Spaceship Spacemail DNS. This desk cannot write the zone.
| Do | Type | Host | Target | Why |
|---|---|---|---|---|
| KEEP | MX | @ | mx1.spacemail.com | Live. Incoming mail for @aurionglobal.site. |
| KEEP | MX | @ | mx2.spacemail.com | Live. Failover MX. |
| KEEP until hosting disconnect, then REPLACE | TXT | @ | v=spf1 include:spf.shared.spaceship.host include:spf.spacemail.com ~all | Live SPF authorizes both Shared Hosting and Spacemail. After LiteSpeed disconnect, drop the shared-host include. |
| KEEP | TXT | spacemail._domainkey | v=DKIM1; k=rsa; p=… (2048-bit key already published) | Live DKIM. Do not paste a second key. |
| KEEP | SRV | _autodiscover._tcp | autoconfig.spacemail.com | Live. Mail client autodiscover. |
| ADD | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:[email protected]; adkim=s; aspf=s | Missing (NXDOMAIN). Start at p=none so reports collect. Raise to quarantine then reject after a week of clean rua. |
| REPLACE SPF | TXT | @ | v=spf1 include:spf.spacemail.com -all | Stop authorizing LiteSpeed/cPanel senders. Hard-fail (-all) once only Spacemail sends. |
- No CAA records — leave empty until Grok's certificate authority is published; a wrong CAA would break HTTPS.
- No AAAA on apex.
- mail.aurionglobal.site has no A — not required for Spacemail.
| Area | On this desk | Confidence |
|---|---|---|
| Custom domain HTTPS | aurionglobal.site: editable Grok A 64.239.109.1 KEEP. Protected LiteSpeed A 66.29.148.167 is Spaceship Shared Hosting — disconnect that connection. Grok Host still 404 until Publish. | High |
| Email (Spacemail) | MX/SPF/DKIM/SRV live 2026-09-17T00:41+03:00. DMARC missing — add _dmarc TXT p=none to [email protected]. After hosting disconnect, drop include:spf.shared.spaceship.host. | High |
| Public existence | This preview and the named hosts | High |
| Business concept | Holdings + Auriexpress + AuriBulk | High |
| Live transactional marketplace | Demo orders only. Catalog samples. | High |
| Live payment processing | No PSO connected. Last-four theatre. | High |
| Production backend / API | This process. PGLite or Neon if configured. | High |
| Authentication / RBAC | Better Auth + buyer-scoped queries + staff gate | Medium |
| Security headers | nosniff / referrer / permissions. Preview is iframed. | Medium |
| Privacy (PDPP 1321/2024) | Notice + request form. Not a certification. | High |
| KYC / AML | Prototype file + AI review. Not an AML officer. | High |
| Export / customs | Document checklist on RFQ. Nothing filed. | High |
| Inventory / fulfillment | Not demonstrated as live stock. | High |
| AI | Optional Grok with timeout. Human still decides. | High |
| Independent pentest | None. Do not claim one. | High |
| NBE SBB/83/2022 | Applies to banks. This desk is not a bank. Map is on Staff → Security. | High |
| GitHub Enterprise / GHES | Not installed. Personal GitHub.com account only. | High |
| Production readiness | No. | High |
What we built against the DD
- Server-side prices. The bag cannot inject cents.
- Buyer orders and vaults are scoped to the session user (BOLA/IDOR gate for those tables).
- Staff vs public: pipeline, engine, and RFQ desks stay behind the staff gate.
- Append-only audit on inquiry, demo order, KYC, privacy requests.
- Rate limits on inquiry, KYC, privacy, and Better Auth.
- Same-site fetch isolation on authenticated server functions.
- Shopper KYC stores last-four of ID only. AI recommends; a human still reads.
- Export pack: checklist only. Not Ethiopian Customs.
- Payment adapter: AURION does not hold customer money. Live capture requires a licensed Ethiopian payment-system operator under NBE. None is connected on this desk.
- Trust chips on listings: Sample / Indicative / No live payment. “Verified” is not used as marketing.
- Mining, energy, aviation remain pipeline pages — no checkout.