Security and data
Security is part of the control plane, not an add-on. This is how Nerveom handles access, records, isolation and your data.
Controls in place
Access
Single sign-on and role-based access are in place and in use.
Audit trail
A record nobody can quietly edit. Every action is kept as it happened, in one timeline from request to rule.
Isolation
Every customer's environment is kept isolated by design, so a configuration mistake can't mix one company's data with another's.
Network Boundaries
An agent's outbound access is scoped to what was actually approved, not what it can talk its way into.
Tripwire credentials
Every credential ships with a decoy planted alongside it. If the decoy is ever used, the agent is shut down instantly.
Instant stop
Suspend one agent or every agent, immediately, from one place. Nothing comes back online until someone decides to restart it.
Where it runs, and where your data stays
Your environment or ours
Nerveom runs as a hosted service, in your own AWS account, or on your own Kubernetes cluster with an AWS KMS key. Support for Azure, Google Cloud and HashiCorp Vault key services is planned.
Approved regions only
You can restrict where agent work is allowed to run to a set of approved regions, enforced as a hard rule. An agent that doesn't declare where it runs is excluded by default.
Leaving cleanly
Your organisation's data is kept separate from every other customer's, so it can be removed cleanly. Retention and deletion terms are put in writing before you sign.
Network head start is opt-in
Off by default. If you turn it on, only trained patterns and anonymised cost figures are shared. Never your queries, never your data.