Neural InverseRequest access

Security and trust

Your code and data stay under your control.

How Neural Inverse protects what you build: where it runs, how it is isolated and recorded, and how to work with our security team.

Where it runs

You choose where your data lives.

Self-hostedRuns on your servers. Your code, prompts and records stay on your network; we receive none of it.
In your cloudRuns in your own AWS, Azure or Google Cloud account, under your keys and network controls.
Air-gappedInstalls from an offline bundle and runs with no internet connection, using models you host.
Hosted by usWe run it for you, with the same controls and audit record: shared in AWS US East (N. Virginia) or Europe (Frankfurt), or dedicated in the AWS, Azure or Google Cloud region you prefer.

Built-in controls

Security that is part of the product.

Tenant isolationEvery organisation's data is separated by the database itself, with row-level security that fails closed.
EncryptionTraffic is encrypted with TLS. Secrets, credentials and sensitive records are envelope-encrypted with keys in a key management service, and you can bring your own keys.
Tamper-evident auditEvery action by a person, agent or command is written to a hash-chained log that can be verified offline.
IdentitySingle sign-on with SAML or OIDC, directory sync with SCIM and LDAP, passkeys and multi-factor authentication.
AI controlsApproved models only, data loss prevention on prompts and context, and approvals for risky agent actions.
Data residencyBind your organisation to a region; its content and processing stay there. On the shared service, sign-in details are held in the United States; dedicated and self-hosted deployments keep them in your region.

AI and your data

Every model request goes through your controls.

One way to modelsEngineers and agents reach models only through the gateway you control, with your approved list.
Checked before it leavesPrompts, tool calls and context pass data loss prevention before they reach a model.
AttributedEvery model request and agent action is tied to a person or an agent identity.
Your keys, your providersUse your own provider agreements or self-hosted models; provider keys stay in the vault.

How we build it

Security tested on every change.

Attack tests in CISecurity tests attack each defence directly, and each test is proven to fail when its defence is removed.
Cross-tenant testsAutomated tests try to read and write across organisations as the runtime database role, on every change.
Fails closedIf an isolation setting, policy check or audit write fails, the request is refused rather than allowed.
No outside callsThe platform makes no calls to external services at runtime, so it runs the same on a closed network.
Watches itselfAdmission control, circuit breakers and supervised background jobs keep the platform stable under load and failure.

Standards

Evidence for your audits.

Govern checks your controls against rule packs for frameworks such as SOC 2, HIPAA, GDPR, ISO 42001 and the EU AI Act, and exports the evidence for your auditors. That evidence supports your certification; it is not a certification of your system or of Neural Inverse. Certification stays with your organisation and its assessor.

For your security review, ask us for our current security documentation and questionnaire responses.

Under a non-disclosure agreement, your team can review the source code, receive our capacity and benchmark reports, and run our benchmark tools on your own hardware.

Report a vulnerability

Found a security issue?

Email security@neuralinverse.com. We acknowledge reports within 72 hours and work with you on a fix and coordinated disclosure.

Documents

Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

Request accessContact us
Strictly necessaryAlways on

Storage the website needs to work, such as remembering these settings. It contains no identifier and is never used to track you.

Google Analytics counts visits and shows which pages are useful, so we can improve the website. It sets cookies and sends your IP address, browser details and the pages you visit to Google in the United States. Google Signals and advertising features are switched off. Off unless you turn it on.

Read the cookie policy

Security and trust · Neural Inverse