Security & deployment
NVector holds the record of what an institution has and has not secured. That makes it a high-value target, and we build it accordingly. Here is what is actually in place — and what is not yet, stated plainly.
Sensitive columns — integration credentials, contact details, electronic signatures, device identifiers and audit-trail IP addresses — are encrypted with AES-256-GCM using a key held separately from the application secret, so rotating one does not compromise the other.
Access is granted through roles and assignments scoped to organisational units. Evidence carries sensitivity classifications, and the platform enforces which roles may open which level.
Every record is owned by an organisation and reached only through that ownership chain. One customer's data is never reachable from another customer's session.
Authentication uses short-lived signed access tokens with separate refresh credentials and a configurable session lifetime, so a stolen token has a narrow window of use.
Every create, update and delete is recorded with the actor, timestamp and before/after values. Trail entries cannot be modified or removed through the application.
Parameterised queries throughout, strict origin allow-lists for cross-origin and form submissions, request and upload size limits, and a configuration that refuses to start in an unsafe production state.
Regulators and internal policies differ on where compliance data may live. Pick the shape that fits yours.
| Model | Where it runs | AI features | Typically chosen by |
|---|---|---|---|
| Cloud | Hosted and managed by NVector | Available | Small and mid-size institutions |
| Cloud without AI | Hosted and managed by NVector | Disabled — nothing leaves for inference | Strict data-sharing policies |
| On-premise | Your data centre, your controls | Optional, using your own provider key | Data residency requirements |
| Air-gapped | Fully isolated, no internet at all | Local model only | Government and critical infrastructure |
Where AI assistance is enabled, data is sanitised before it leaves the platform: personally identifiable information — names, national identity numbers, account numbers and phone numbers — is stripped so the model receives anonymised text.
AI output is always advisory. It drafts, scores and suggests; a named human approves before anything is recorded as a compliance decision or sent to a regulator.
If that is still not acceptable under your policy, run the cloud-without-AI, on-premise or air-gapped model and the feature is simply not present.
NVector is an actively developed product. We hold no third-party security certification today and we will not imply otherwise on a marketing page — a compliance vendor claiming unverified attestations would be the wrong place to start a relationship.
What we will do is answer a security questionnaire in full, walk your team through the architecture, and support a penetration test against a dedicated environment before you commit.
Found something? Email security@nvector.io. We will acknowledge within two business days and will not pursue good-faith researchers.
We will complete it properly rather than pointing you at a trust page.
