The evidence behind our security claims, not just the claims.

Mechanical quote location

Every quote a specialist supplies is located in the exact material submitted for the run, with a character span. Model-written quotes that cannot be found are labelled Insufficient evidence and cannot be marked source verified.

Separate interpretation review

A reviewer on a different model checks whether each located passage supports the claim. Agreement between models is treated as a review signal, not proof.

Uncertainty instead of filler

Gaps and missing clauses describe what was searched rather than citing absent text. Unresolved findings stay visible and the brief is released as incomplete when checks do not pass.

Version-pinned document citations

Desk catalog documents reach the engine pinned to an exact stored version, so a replacement upload does not redirect old citations.

Page, bounding box and OCR quality references

Citations that point to a page region of a scanned original, with OCR quality warnings and a side by side viewer.

Authoritative legal source checks

Claims about what the law requires, checked against a dated, jurisdiction specific legal source. Today a contract citation supports only what the contract says.

Enterprise hosted

Encevra managed infrastructure calling approved third party model providers (OpenAI, Anthropic, Google DeepMind). Customer content leaves our infrastructure for inference at those providers.

Server-enforced model policy

Every specialist call, retry and fallback is checked against an approved model list before it is sent. A blocked call stops the attempt instead of rerouting content. Policy is set per deployment today, not yet per workspace.

Customer private cloud

Runtime in your cloud account using local models or inference endpoints you approve, with disclosure whenever data leaves your account. Requires packaging the runtime, storage, queues and authentication away from our managed backend.

On-premises and air-gapped

All runtime services and models running locally with no external connectivity, including installation, authentication, telemetry, licensing and updates. Hosted proprietary models are not available offline, and results may differ on local models. A private endpoint or your own API key is not air-gapped.

Region, retention and support access controls

Per customer settings for processing region, retention and deletion windows, and customer-approved support access.

TLS 1.2+ in transit

Every connection to the application, the public Noetis API and the database is encrypted in transit, with HSTS and strict transport security headers applied at the edge.

Encryption at rest

Documents, extracted text, findings and decision records are stored in managed Postgres and object storage with disk-level encryption at rest.

Credential hashing

API keys are stored only as hashes. A key is shown once at creation, can be given an expiry, and can be revoked immediately without affecting other keys.

Customer-managed encryption keys

Bring-your-own-key encryption for document storage, for organisations with a key management requirement.

Row-level isolation on every table

Decisions, evidence, findings, feedback, decision records, runs and keys are all constrained at the database layer to their owning account. An identifier supplied in a request is a selector to be authorised, never a claim to be believed.

Server-only writes for the evidence record

Findings and decision records cannot be written or edited by a client. They are produced by the analysis engine and by explicit release actions, so the audit trail cannot be rewritten after the fact.

Isolation carried through background work

Queued analyses, workers and document downloads re-check ownership rather than inheriting trust from the request that created them.

Organisation workspaces with roles

Shared team workspaces with per-role permissions, so several reviewers can work one decision under separate identities.

Data residency selection

Choice of processing and storage region, including EU-only processing.

Append-only security event log

Authentication events, API credential use and failures, approval changes and abuse signals are written to a log that the application cannot update or delete. Raw addresses are never stored; only a one-way hash used for correlation.

Versioned decision records

Each released decision record freezes the evidence used, the analysis version, every finding, every accept, reject or change your reviewers made, and the decision a human took. Versions are immutable.

Credential-probing protection

Repeated invalid API credential attempts from the same origin are blocked automatically and recorded.

Customer-exportable audit trail

Self-serve export of workspace audit events and decision records for internal review.

Log streaming to your SIEM

Forwarding of workspace audit events to Splunk, Sentinel or an S3 bucket you control.

Control design and evidence baseline

Access control, encryption, logging, change management and vendor review documented and enforced in code rather than policy alone.

Independent penetration testing

Recurring testing of the application, the public Noetis API and the analysis engine by independent security firms. Results are tracked to closure and shared with enterprise customers under NDA.

SOC 2 Type I readiness

Formal readiness assessment, mandatory administrator multi-factor authentication and vendor terms review across every model provider.

SOC 2 Type II observation period

A continuous observation window with an accredited auditor, followed by the Type II report.

ISO 27001

Pursued after SOC 2 Type II, where enterprise demand justifies it.

Credential disabling and workload suspension

Any API key, account or queued workload can be disabled immediately without a deployment, and spending caps are enforced at job creation rather than detected afterwards.

Evidence preservation

Security events, run history and decision records are retained in append-only form so an investigation can reconstruct what happened.

Documented response runbook and severity ladder

Named on-call ownership, defined severity levels, containment and recovery steps, and isolated backup restoration drills.

Contractual breach notification windows

Committed customer notification timelines written into enterprise agreements and the data processing addendum.

Public status page

Live availability of the API, database, runs and webhooks with 90 days of daily run history, at encevra.com/status.