Trust Center
The architecture, controls, and posture behind the platform — written for the people who run your security review.
Enterprise buyers get burned by inflated compliance pages, so this one is deliberately precise: what the platform is designed for, what it is aligned with, and what remains a roadmap item.
The platform is built on SOC 2-relevant controls from day one: immutable audit logging, least-privilege access, change management through reviewed pull requests, and encryption everywhere. A formal Type II attestation is planned; ask us for the current control mapping.
The platform architecture supports HIPAA alignment: audit controls, access controls, and transmission security map to the Security Rule’s technical safeguards. AWS services underneath are HIPAA-eligible. Customer-managed KMS encryption (§164.312(a)(2)(iv)) is available at the Enterprise tier. BAA discussions happen as part of Enterprise procurement.
Key management can follow NIST 800-53 practice at the Enterprise tier (customer-managed CMKs, CloudTrail-evidenced decrypt operations, reviewed key policies — the SC and AU control families). The platform runs on AWS regions and services with existing FedRAMP authorizations. A NuBench authorization is a roadmap conversation, not a current claim.
Single-tenant deployment, configurable retention, and export tooling support data-processing obligations. Deletion and export workflows for data-subject requests are in development. Customer data is not used to train models.