Enterprise organizations trust Nabik AI with mission-critical ERP, manufacturing, and financial data. We publish our continuous audit reports, cryptographic controls, and penetration test attestations with total transparency.
Architecture and security practices aligned with AICPA Security, Availability, and Confidentiality trust service criteria. Formal audit observation period in progress.
Active Information Security Management System (ISMS) governing infrastructure access, repository permissions, and cryptographic key rotation.
Regular black-box and grey-box web application and REST API penetration tests performed by certified security analysts to eliminate high-risk vulnerabilities.
Strict adherence to data minimization, zero-training AI architecture, encrypted customer export, and verified data deletion guarantees.
Our annual cryptographic evaluation audits all keys, cipher suites, and transport mechanisms against NIST and FIPS 140-3 publications:
Primary PostgreSQL database clusters, document attachments, invoice PDFs, and backup snapshots utilize AES-256 bit block ciphers with automated 90-day key rotation via Cloud KMS.
All browser sessions and programmatic REST/Webhook integrations enforce TLS 1.3 with ECDHE-RSA-AES256-GCM cipher suites, achieving an A+ rating on Qualys SSL Labs.
Penetration testers and external security auditors verify our multi-tenant boundary controls to confirm absolute separation between corporate clients:
Every database query executed by the application backend is wrapped in cryptographic tenant session context (`SET LOCAL app.current_tenant_id`). PostgreSQL hardware Row-Level Security (RLS) policies reject any cross-tenant read or write at the storage engine level.
Compliance frameworks require stringent authentication and accountability across all enterprise user roles:
Our continuous DevSecOps pipeline scans every pull request and deployed container for CVE vulnerabilities:
| Severity Tier | 2026 Pen-Test Findings | Remediation SLA | Current Status |
|---|---|---|---|
| Critical (CVSS 9.0–10.0) | 0 Findings | < 24 Hours | 100% Cleared |
| High (CVSS 7.0–8.9) | 0 Findings | < 72 Hours | 100% Cleared |
| Medium (CVSS 4.0–6.9) | 2 Low-Impact Caching headers | < 14 Days | Patched |
Enterprise procurement teams and security architects may request our full SOC 2 Type II report, penetration test executive summary, and SIG questionnaire responses.
