Security at NeverTrust.ai

The NeverTrust agent inspects AI traffic locally, on the device where it runs. Request and response content is scanned by an embedded machine-learning model that ships inside the agent binary. Full request and response bodies are never transmitted to our servers.

What reaches the management portal is metadata: classification scores, event types, device identifiers, and timestamps. Flagged security events may include short content snippets (up to 512 characters) to give reviewers context; organisation administrators can disable snippets entirely. The agent's local certificate-authority private key is generated on the device and never leaves it.

All traffic between the agent, the portal, and your browser is encrypted in transit with TLS. Data at rest, including the database and stored objects, is encrypted using AWS-managed encryption. Secrets used by our infrastructure are stored in AWS Secrets Manager, not in code or configuration files.

Every organisation's data is isolated by row-level security policies enforced in the database itself, beneath the application code. Partner organisations see only their own tenants; standard organisations see only their own data. Cross-organisation access is limited to our vetted internal administrative tooling.

Portal sign-in uses email magic links. We do not store passwords. Sessions are bound to HMAC-signed cookies with a four-hour lifetime, and agent API access uses per-device keys stored only as SHA-256 hashes. Public endpoints are rate limited per IP address.

All card handling goes through Stripe Checkout and the Stripe Customer Portal, both hosted by Stripe. Card numbers never touch NeverTrust.ai servers or our browser application code.

Security events are purged on a schedule: unreviewed events after 30 days, reviewed events after 90 days. When an organisation is deleted, its data enters a 30-day grace period and is then permanently removed. See the Privacy Policy for the full retention schedule.

We use a small set of infrastructure providers to deliver the Services. The same list appears in our Data Processing Agreement.

We do not currently hold third-party certifications such as SOC 2 or ISO 27001. Our controls are documented on this page and contractually committed in our Data Processing Agreement. Enterprise customers with specific compliance requirements can talk to us about their needs.

We welcome coordinated disclosure. Report suspected vulnerabilities to [email protected] with enough detail to reproduce the issue. We will acknowledge your report, keep you informed of progress, and credit you if you want credit. Please do not access other customers' data or degrade the service while testing.