Security & Trust

Security is core to building software for financial businesses. This page is the single reference for a buyer's security review: how we encrypt and access data, who our sub-processors are, our privacy and compliance posture, and how to reach us. A controls summary and additional detail are available to customers under NDA.

Data protection

• Encryption in transit. All traffic to our sites, APIs, and services is served over TLS 1.2+. Plaintext HTTP is redirected to HTTPS.
• Encryption at rest. Data stored in our cloud is encrypted at rest with AES-256.
• Access control. Administrative access requires multi-factor authentication and follows least privilege; access is scoped to what a task needs and reviewed.
• Data minimization. We collect and retain only the data a task requires, and prefer read-only, in-memory processing over storage (see below).
• Tenant isolation. Customer data and workloads are isolated per tenant; a separation and tenancy model governs the boundaries between products.
• Auditability. Sensitive actions are logged to an append-only trail and are reviewable.
• Trusted infrastructure. We build on established cloud and edge providers (below) and keep dependencies current with automated scanning.

Sub-processors

We use a small, deliberate set of third parties to operate our services. Each is bound by its own data-protection terms; none is used to train models on customer data.

• Amazon Web Services — cloud hosting, compute, and storage (US regions).
• Cloudflare — edge network, DNS, TLS, and static hosting.
• Anthropic — model inference for products that read documents. Anthropic does not train on API data and retains inputs only briefly for abuse monitoring under its API terms. No figure in a report originates from a model; every number is computed by deterministic code.
• Per-product data sources — where a product connects to a customer's systems, it does so through the customer's chosen, read-only integration (for example Plaid or Rutter for finance-operations products). These are disclosed in the applicable product agreement.

Customers on a product agreement receive advance notice of any change to the sub-processors that touch their data.

Privacy & compliance

• GDPR & CCPA. Our practices are designed to align with GDPR and CCPA; we act as a processor (or sub-processor) of customer data and offer a Data Processing Agreement. See our Privacy Policy.
• SOC 2. Nyx Foundry is preparing for SOC 2. We are selecting an audit partner to begin a Type 1 examination, targeted for Q4 2026, with a Type 2 report to follow. A summary of our controls is available to customers under NDA today. We would rather be precise about where we are than imply an audit we have not completed.
• Penetration testing. Independent penetration testing is part of our security program; an executive summary is shared with customers under NDA on request.

How we handle your documents

For products that read your files, such as Horkos, the same commitments apply on every run:

• Read-only. The engine reads and recomputes. It never moves money and never writes back to your systems.
• Processed in memory, then discarded. Documents are used for the run and not retained. They are not stored and not used to train any model.
• Models. We use Anthropic Claude to read and to verify (Sonnet for extraction, Opus for the adversarial check). No number in a report originates from a model; every figure is computed by deterministic code and cited to its source.
• NDA first. A mutual NDA is in place before any document changes hands, and you keep the report.
• Audit trail. Each run appends an audit-log entry: document fingerprint, values read, lines recomputed, breaks flagged, and review status.

Responsible disclosure

If you believe you have found a security vulnerability in one of our sites or products, we want to hear from you. Please email [email protected] with a clear description and steps to reproduce.

We ask that you:

• Give us a reasonable chance to investigate and fix the issue before disclosing it publicly.
• Avoid accessing, modifying, or deleting data that is not yours, and avoid degrading our services.
• Do not run automated tests that generate significant load, and do not attempt denial-of-service, social engineering, or physical attacks.

For good-faith research that follows these guidelines, we will not pursue legal action, we will work with you on a fix, and we are glad to credit you if you wish. We do not currently run a paid bounty program.

Contact

Security reports and questions: [email protected].