Security Program
Project Knox
Project Knox is the standing security program governing Encevra and the Noetis engine. It establishes the architecture, controls, and review cadence that protect customer documents, prompts, outputs, credentials, and spending across the full platform. All customer data is treated as confidential by default.
The program is measured against OWASP Application Security Verification Standard Level 2, with the OWASP API Security Top 10 assessed concurrently. Encevra does not represent a partial review as full compliance and does not publish a security score.
Program pillars
Four principles govern every design and review decision under Project Knox. They are enforced in code, not merely documented in policy.
Zero-trust document handling
Every customer submission and every model output is treated as untrusted input. No document content can grant itself elevated permission, trigger a downstream action, or promote unverified material into a released finding. The boundary between submitted content and authoritative system state is absolute.
Server-authoritative access control
Identity is established exclusively through a verified session or a verified API credential. Any organization or user identifier supplied in a request is treated as a selector requiring authorization, never as a self-attested claim. Privileged roles cannot be self-assigned.
Atomic spending enforcement
Usage limits are applied at the moment a job is created, in the same indivisible database operation as the allowance check. Parallel requests cannot race past a cap, and billable operations are bounded by hard ceilings rather than monitoring alone.
Evidence over assertion
Encevra does not claim compliance from a partial review, does not publish a security score, and does not represent the platform as impenetrable. Controls are stated only to the extent they have been implemented and tested, and limitations are disclosed openly.
Independent security assessments
Encevra recognizes that internal review cannot serve as the final word on its own security posture. The company has established partnerships with independent security firms to conduct recurring penetration testing and comprehensive security assessments of the Encevra application, the public Noetis API, and the analysis engine. These engagements are structured to evaluate the platform against the same adversarial conditions a real attacker would apply.
Findings from each engagement are tracked to closure under Project Knox and incorporated into subsequent hardening cycles. Material results are available to enterprise customers under NDA upon request.
Vulnerability disclosure
Responsible disclosure is welcomed and encouraged. Submit findings to security@encevra.com with sufficient detail to reproduce the issue. Do not test against other customers' data, do not execute denial-of-service attempts, and allow a reasonable remediation window before public disclosure. Encevra will acknowledge receipt, communicate its assessment, and provide attribution credit where requested.