Security
Control is part of the architecture.
Inversiq is built so data, computation, review, authority and action stay scoped and traceable across the decision path — not bolted on afterward.
What every request carries
Security by design
Control starts at the system boundary.
Every request enters through one identity and one tenant. Nothing reaches a connected system, and nothing executes, before it has passed through Inversiq's own review and authority checks.
Tenant
One workspace, one identity.
Inversiq
Controlled systems
Read, then act only when approved.
Isolation, action, authority and audit are each their own chapter further down this page — this is the shape they all sit inside.
Data & tenant isolation
One identity, one workspace, no shared query path.
Every workspace, model instance and review record belongs to exactly one tenant, and every query that reaches one resolves through that tenant first.
Organisation A
Workspace A1
Workspace A2
Documents, model runs, findings, reviews and decisions all carry this tenant.
Organisation B
Workspace B1
Documents, model runs, findings, reviews and decisions all carry this tenant.
Every query resolves in this order
Cross-tenant request
404not 403
A refusal would confirm the record exists. The boundary does not disclose that a resource it will not serve is there at all.
Scoping is enforced in application code at every query boundary, and covered by a standing tenant-isolation test category. Row-level controls at the database layer are planned alongside the PostgreSQL migration. They are not in place today.
Data surfaces, stated as they are
In transit
In placeAuthenticated sessions, a CORS allow-list, rate limiting and request logging bound to tenant and source address.
Connector credentials
In place, boundedEncrypted at rest with a symmetric key. Not a key-management service, not per-tenant keyed and not rotatable without re-encryption, stated because it is the kind of detail that matters.
Documents at rest
Host-providedEncryption at rest is whatever the hosting environment provides. A managed key service is on the roadmap; customer-managed keys are not offered.
Retention & deletion
PlannedNo lifecycle, archive, legal-hold or deletion policy is implemented. Retention and export are agreed contractually and handled per environment.
Customer data is not used to train models. Document classification and field extraction call an external model provider under contract; the calculation path calls no language model at all.
Controlled actions
Propose, approve and execute are never the same step.
An action on a connected system moves through four separate operations. Skipping one is not an option — execution has nothing to check unless the step before it actually happened.
Propose
An outbound action to a connected system is proposed.
Approve
Approved as a separate operation. The proposer cannot also approve.
Execute
Execution refuses unless the action already carries an approval.
Record
Written to an append-only event table, actor resolved server-side.
The Decision Agent itself has no tool registry and no write path: it answers from context it already holds, and cannot take an action of its own.
Today this governs one path — an outbound action to a connected system — not a general workflow-automation framework. No agent gains a write capability of its own before agent contracts, a tool registry, action- governance classes and agent evaluation all exist.
Auditability
Every material action leaves a trace.
A reviewer arriving a year later can see what was known, what ran, what was questioned, who decided and what happened next.
Finding
Lease break option conflicts with the occupancy assumption.
Model values carry a cell-level reference. Document links are document-scoped: page and span anchors are on the roadmap, not in place.
Model run recorded
Immutable · input hash sha256 3f9c…a17b · engine version pinned
Assumption provenance captured
Sheet-and-cell reference stored with the value
Finding raised
Deterministic rule, not a model judgement
Escalated for review
Analyst override stored outside the generating engine
Verdict recorded
Conditional · investment manager · recorded against the designated run
Audit event written
Append-only · actor resolved server-side, not supplied by the client
Events are never updated or deleted; a superseded decision is written over by a new row, not erased.
Stated plainly: the record is append-only by construction, but it is not yet tamper-evident — there is no hash chaining or signing. There is no retention or archival policy, and no single cross-object audit query surface. All three are roadmap items.
Illustrative interface. Fictional decision.
Enterprise security
What exists today, and what does not.
Inversiq holds no third-party security certification. The two columns are kept strictly separate: one describes controls in place, the other describes work not yet done.
Identity & authentication
In place today
Authenticated sessions, hashed credentials, expiring reset tokens, rate limiting.
Planned, not available
Single sign-on, SCIM provisioning and multi-factor authentication. Not available today.
Tenant isolation
In place today
Enforced at every workspace, model and review query boundary, with standing isolation tests.
Planned, not available
Row-level controls at the database layer, alongside the PostgreSQL migration.
Decision authority
In place today
Fail-closed on the final investment decision and the run it is recorded against. No admin bypass.
Planned, not available
A general permission model, separation of duties and approval thresholds.
Auditability
In place today
Append-only event tables with a server-resolved actor and no update or delete path.
Planned, not available
Tamper evidence, a retention policy and a cross-object audit query surface.
Secrets & keys
In place today
Symmetric encryption for connector credentials; a startup guard that refuses static cloud keys.
Planned, not available
A managed key service replacing the single application key, with rotation.
Secure development
In place today
No database, framework or network call in the calculation path, enforced by import-purity and tenant-isolation guards rather than by convention.
Planned, not available
Dependency and vulnerability scanning in CI, and a threat model maintained per surface.
Independent testing
In place today
Not started
Planned, not available
Penetration testing ahead of enterprise go-live.
Incident response
In place today
Not started
Planned, not available
Severity definitions, escalation path, customer notification and post-incident review.
SOC 2
In place today
Not started
Planned, not available
Control mapping and evidence collection precede any audit. Prerequisites in place: append-only audit tables, tenant isolation, backup and restore.
ISO 27001
In place today
Not started
Planned, not available
The same path. Certification lead time, rather than engineering effort, is the constraint.
Architecture documentation, deployment boundaries, sub-processors and data-handling terms are covered in the security review rather than published here.
Request a security review