Security & Trust
A compliance platform should survive its own audit.
How we build, ship, and secure NURA, stated plainly so your reviewers can hold us to it.
How we build it.
Every change on the record.
Evidence gets a fingerprint when it’s collected. Corrections are added beside the original, and administrative actions are recorded the same way.
An administrative action is added to the evidence history like any other record.
Tenant isolation at the database.
Row-level security enforced in PostgreSQL, with isolation validated in testing, not promised in a policy document.
A query from one tenant toward another is blocked by row-level security.
Signed, inventoried releases.
Every release ships as signed container images with a software bill of materials.
A release image receives its signature and a software bill of materials.
Encryption throughout.
Data encrypted in transit and at rest, with FIPS-capable cryptographic builds for government deployments.
A locked packet crosses between services and the disk is locked at rest.
A documented secure SDLC.
Mandatory code review, vault-based secrets management, and provenance-tracked builds. The documentation is available to customer security teams under NDA.
A change moves through review, a provenance-tracked build and vault-held secrets.
Disclosure welcome.
Found something? We respond, we fix, we credit.
A reported issue becomes a fix and a credit; then the whole stack is lit.
“Can I see what changed, and why?”
Most platforms answer with access logs and trust. NURA keeps every version of a record with its fingerprint, so your own assessor can recompute the history on their own machine.
Put NURA in front of your reviewers.
Bring your security team’s questions. We’ll answer them against a live environment.