Security
Nimmy holds register data, board papers and licensed regulatory text, which makes it exactly the kind of system your own security review exists to interrogate. Here is what is in place, and below it, plainly, what is not.
Tenants are separated in the database
Every tenant-scoped table carries the organisation it belongs to, and PostgreSQL row-level security enforces it. The application connects as a role that cannot bypass those policies, so a query that forgets its tenant returns nothing rather than returning somebody else’s register. Cross-tenant reads happen in exactly two places — the anonymised community aggregates and the public publishing pages — and both are written to be cross-tenant on purpose.
A firm’s clients are walled from each other
Advisory firms run a workspace per client. Workspaces in different wall groups cannot be joined in one query, which is the constraint a firm’s conflicts policy actually needs and the one an access-control list alone does not give.
Identity is yours to control
SSO over SAML or OIDC, and SCIM provisioning by signed webhook. Deprovisioning marks a membership rather than removing it, because the audit trail names that person on every decision they made and a trail with a hole in it is not a trail. Their outstanding work is surfaced for somebody to pick up rather than silently reassigned.
The trail is append-only
Every state transition, approval, applicability decision, export and send writes an audit event that is never updated or deleted. Exports of the trail are available to tenant administrators. The point is not that we keep records; it is that the records cannot be tidied afterwards.
Provenance on every document
Each document in the corpus carries when it was published, detected, indexed, delivered and first viewed, along with a stored snapshot of the bytes as they were fetched and a content hash. When a regulator edits a page quietly, the snapshot is what shows what it said on the day you read it.
Encryption and secrets
Encrypted in transit and at rest. Secrets live in the deployment platform’s managed store, never in the repository. HTTP responses carry HSTS, a frame-ancestors policy, nosniff and a restrictive referrer policy.
AI does not train on your data
Model calls go to a single configured provider over an OpenAI-compatible endpoint. Your content is not used to train models. Every call is logged with its prompt, output, model and cost, and a tenant can switch any individual AI function off.
Residency
Nimmy deploys as a self-contained image and can run in a chosen region. The pilot runs in Singapore. If you need a specific jurisdiction, that is a deployment decision to make before you start rather than a setting to change later — tell us early.
What is not in place yet
- No SOC 2 report. Nimmy is not certified. The logging, change management and access review practices a Type II audit examines are being run from now so that the observation window is real when we start, but we have no report to give you today and will not imply otherwise.
- No penetration test report. One is planned before general availability.
- No customer-managed keys. Encryption keys are managed by the platform.
Reporting something, or asking something
If you have found a vulnerability, write to us and we will acknowledge it within two working days. Security questionnaires go to the same address.
[email protected]