Trust centre
Security, compliance, and operational proof
NERVA is designed for organisations that must explain autonomous routing — with evidence exports, policy gates, tenant isolation, and sovereign deployment options.
Certifications roadmap
- • SOC 2 Type II — readiness artefacts in procurement bundle
- • ISO 27001 — control mapping via evaluation exports
- • HIPAA / regulated health — AdventureWorks regulated demo tenant
- • Sovereign / air-gap — Litware profile with runtime enforcement
Data handling
- • Tenant-scoped Postgres with application-layer isolation
- • Optional Postgres RLS policies (`prisma/sql/tenant-rls.sql`)
- • Encrypted tenant secrets vault for connector credentials
- • Audit export JSON/ZIP for every decision lifecycle
Access control
- • Eight RBAC roles with middleware enforcement
- • OIDC / PKCE for production SSO
- • Per-tenant intake API keys for headless partners
- • Constitutional policy gates before auto-route
Evaluation artefacts
- • Procurement evidence ZIP per tenant
- • Investor brief PDF/HTML/JSON
- • 13 automated show-stopper demo scripts
- • OpenAPI v0.2 + @nerva/sdk reference client