Security is built into the platform.

Identity & access

Named accounts, signed sessions, separated roles.

Access starts with a provisioned person. Signing in gives access to your tenant, never authority to decide.

Provisioned accounts

Accounts are created by name. Self-registration is closed outside development.

Signed, expiring sessions

Sessions are signed, held in HttpOnly cookies and expire.

Credential handling

Passwords are hashed with bcrypt. Reset links are single-use, time-limited and stored hashed.

Separated integration roles

Configuring a connector, importing through it and approving its actions are distinct roles.

Single sign-on

Not available yet. Enterprise identity federation is on the platform roadmap.

Tenant isolation

Your data stays inside your tenant.

Inversiq is multi-tenant. Isolation is logical: tenants share the application and its database, and tenant scope is enforced in the application on every request that touches your data.

Resolved on the server

Your tenant comes from the signed-in user, never from anything the browser sends.

Scoped on every query

Every workspace, model and review query is filtered to your tenant.

Other tenants return not found

A record from another tenant is not shown and not acknowledged.

Tested before every release

Tenant-isolation tests run in the blocking suite every change must pass before it can deploy.

Data protection

Encrypted, private and scoped.

Documents and data are held in private storage under your tenant, and protected in transit and at rest.

In transit

Data in transit is encrypted with TLS.

At rest

Storage is encrypted at rest by the hosting platform.

Document storage

Documents sit in private object storage under tenant-scoped paths.

Connector credentials

Encrypted at rest by the application. Outside development the service will not start without a valid key.

Hosting, region and retention

Covered in the security review, with sub-processors and data-lifecycle terms.

Application & infrastructure

Guarded releases and safe defaults.

Every change is tested before it ships, and the service refuses to run with an unsafe configuration.

Blocking test suite

Tenant isolation, calculation purity and database migrations are tested before any change can deploy.

Fails safe on start

Outside development the service will not start without its production database, durable storage and a valid encryption key.

Narrow surface

Cross-origin requests are allow-listed, and API documentation is not served outside development.

Auditability & logs

Control events are recorded, and kept.

Consequential actions leave a record that is added to, not edited. Each surface is kept as its own record.

Review notes and item decisions

Append-only, with the actor resolved on the server.

Run designations and final decisions

Stored with the actor, their role, the rationale given and the policy version that applied.

Connector events

Append-only, with the actor resolved on the server.

Superseded decisions

Kept and marked, never removed.

AI & model security

Models assist. They do not decide.

Language models handle reading and extraction. Numbers, state and decisions sit behind deterministic and human boundaries, which limits what any model output can change.

No training on your data

Inversiq does not train or fine-tune models on customer data.

A narrow role for language models

An external provider classifies documents and extracts fields as structured output. The provider and its terms are disclosed in the security review.

No model in the calculation path

Model runs are deterministic, version pinned and input-hashed, and a blocking test keeps language models out.

Output is not authoritative

The Decision Agent has no tools and no write path. A final decision needs a person with an assigned authority role.