Log inBook a demo

Security

Engineered to institutional controls.

Every architectural choice enforces enterprise-grade security by default. Row-level data isolation. Hardware-attested elevated actions. A cryptographic audit trail your CISO can walk end-to-end.

Engineered against

Every risk category answered at the substrate.

Data isolation is enforced by the database, not the application — an application bug cannot leak one client’s row to another. Elevated operator actions require the Cradle in the port and a biometric only your operator can provide. Every model call, tool invocation, and approval lands in an append-only audit chain your auditor verifies independently. Supply-chain integrity closes through signed builds and continuous dependency scanning. Identity is unified through your SSO with per-workload attribution. The layers that follow name which architecture layer answers which category.

Every byte encrypted, every key attested.

Data at rest: AES-256-GCM. Data in transit: TLS 1.3 only. Sensitive columns get application-layer encryption with per-client keys — a breach that reaches one client’s data can’t decrypt another’s. Master keys live in a hardware security module. Rotation is scheduled and audited. On the enterprise tier: bring-your-own-key against your own KMS.

Your SSO. Your identity boundary.

Users authenticate through your existing enterprise SSO (SAML 2.0, OIDC) with SCIM provisioning. MFA required on every operator session. Service accounts and workload identities are separate classes with separate scopes; secrets live in an HSM-backed vault with break-glass audit. Production access is on-call-only, time-bounded, session-recorded, and attested.

05b · NIST SP 800-53 control mapping

The controls the substrate implements.

  1. AC-3(2) · Dual Authorization

    The L3 two-person rule enforced in hardware via co-signature of Architect Cradle + Developer Cradle.

  2. AC-5 · Separation of Duties

    The tier-gate role model. L1 / L2 / L3 factor composition is a role separation enforced at the substrate.

  3. IA-11 · Re-authentication

    Session re-verify at every tier boundary. Elevation from L1 to L2 requires fresh biometric + Cradle presence assertion.

  4. SC-28(1)(2)(3) · Protection at rest, offline, crypto keys

    AES-256-GCM at rest for platform-side storage; the Cradle encrypted volume carries client keys offline, protecting per-client DEKs from any Nebbos-side breach.

  5. SC-12 · Cryptographic key establishment

    Per-client data-encryption keys wrapped by KMS-hosted master keys. Rotation cadence documented; access logged to Layer 15.

  6. SC-13 · Cryptographic protection

    TLS 1.3 in transit. AES-256-GCM at rest. FIPS 140-3 Level 3 on the K350 module.

  7. AU-2 through AU-12(1) · Audit-trail family

    Eleven controls in the audit family alone. Every request, every action, every approval hash-chained into Layer 15 · Attestation.

Which architecture layers enforce security

Which architecture layers enforce security.

  1. Layer 01 · Data

    Row-level client isolation, encryption at rest, per-client DEK. The primary defense against cross-client leakage.

  2. Layer 02 · Identity

    SSO + SCIM, service-account isolation, workload identity, break-glass audit. Every request carries verifiable identity.

  3. Layer 11 · Approval

    Every consequential action requires attested human approval. Structural defense against autonomous exfiltration or state change.

  4. Layer 14 · Observability

    Real-time detection of anomalous access patterns, credential misuse, client-boundary anomalies.

  5. Layer 15 · Attestation

    Append-only audit trail for every access, every action, every approval. The forensic record.

Incident response commitments

Incident response commitments.

  1. Detection

    24×7 automated monitoring on security-relevant signals with paged responder rotation.

  2. Triage

    Severity assigned within 30 minutes of alert. Severity 1 (confirmed data-integrity or confidentiality breach) triggers executive escalation.

  3. Client notification

    Severity 1 clients notified within 24 hours of confirmed impact; severity 2 within 72 hours.

  4. Regulator notification

    Where regulatorily required (GDPR 72-hour, HIPAA 60-day, various state-privacy), we support client filing with a prepared evidence packet.

  5. Post-incident review

    Written post-incident report shared with impacted clients within 30 days of resolution. Root cause + specific remediation.

  6. Tabletop cadence

    Full-team tabletop exercises quarterly. Table-level scenarios monthly.

Security-team questions

Security-team questions we field weekly.

  1. Do you support customer-managed encryption keys?

    Yes — BYOK on the enterprise tier. Interim tiers use per-client DEK managed by our KMS with documented rotation cadence and access logging.

  2. What is your patch cadence for dependencies?

    Automated dependency updates weekly. CVE-driven emergency patches merge within the SLAs above.

  3. Do you segregate production data from non-production?

    Yes. No production data flows into staging or development environments. Test data is synthetically generated.

  4. What is your OWASP Top-10 posture?

    Every category has documented controls. Injection defended by parameterized queries + typed ORM. Broken access control defended by RLS + application-layer authz. Cryptographic failures defended by TLS 1.3 + AES-256-GCM. Full matrix under NDA.

  5. Do you have a bug-bounty program?

    Invitation-only for research partners. Broader public program available on the enterprise tier.

  6. How do you handle prompt injection?

    Structural defenses at Layer 08 · Reasoning (input sanitization, tool-call authorization) plus Layer 11 · Approval (every consequential action requires human sign-off, so a prompt injection cannot autonomously act). Adversarial testing continuous.

Sub-processors

Sub-processors.

  1. Hyperscaler infrastructure provider

    Compute, storage, networking. US + EU regions. SOC 2, ISO 27001, FedRAMP where applicable.

  2. Postgres-managed hosting provider

    Primary transactional data plane. SOC 2, ISO 27001.

  3. KMS provider

    Master key management. SOC 2, ISO 27001, FIPS 140-2 Level 3 HSM.

  4. Model providers

    Anthropic, OpenAI, Google. Configured per client. Zero-retention default where supported.

  5. Observability provider

    Metrics + tracing + log aggregation. SOC 2, ISO 27001.

  6. Email and notification providers

    Transactional email, incident notification. SOC 2.

  7. Legal and compliance tooling

    Contract lifecycle management, DPA workflow. SOC 2.

Question we have not addressed?

security@nebbos.aiSee compliance
Security · Enterprise-grade by architecture — Nebbos