Security Practices
This page describes security controls that are currently implemented in Nyrava. It does not claim any certification (SOC 2, ISO, HIPAA, etc.) that Nyrava has not obtained. If your engagement requires a specific certification, please contact us before use.
Authentication
Access to Nyrava requires authenticated sign-in. Session state is managed by the platform's authentication provider; passwords are never stored in application code.
Authorization & Row-Level Security
Every request in the application is scoped to the authenticated user's workspace. The database enforces row-level security policies so that one workspace cannot read or modify another workspace's rows, even if application code were bypassed.
Role-Based Access
Administrative capabilities are gated by a separate role table with server-side checks. Roles are never inferred from client-side state.
Encryption
Data is encrypted in transit (TLS) between your browser and the platform. Data at rest is protected by the underlying managed infrastructure. Provider API keys you add in Settings are encrypted before being stored.
Audit & Telemetry
The application records pipeline runs, engine executions, and administrative actions to internal audit tables so that any analysis can be traced back to the inputs that produced it.
Data Isolation for AI Requests
When you bring your own provider API key, requests originating from your workspace are sent to the provider you selected. See the AI Transparency page for details.
Reporting a Vulnerability
If you believe you have found a security issue, please report it via the Contact page. We appreciate responsible disclosure and will respond as quickly as possible.