Security Architecture
This page documents how VertexNirvana builds, secures, and operates every product we ship — including VN Estate OS — for CTOs, CISOs, procurement teams, and compliance reviewers.
Control layer
Identity · Encryption · Audit · Monitoring
Encryption at rest
AES-256
Encryption in transit
TLS 1.3
Password hashing
bcrypt / Argon2
Vulnerability triage
< 24 hrs
Audit log retention
Policy-driven
Access model
Zero standing privilege
Pen testing
Annual + on-demand
Session expiry
Configurable
Security controls
Security is distributed across identity, data, infrastructure, observability, and compliance rather than isolated to a single control layer.
Role-based access control enforced at every resource layer. Permissions follow least privilege — no standing access, all elevated rights are time-bounded.
Data is protected across its lifecycle. AES-256 at rest, TLS 1.3 in transit, key management isolated from application logic.
Every action is immutably logged with actor identity, timestamp, and resource context. Audit trails are tamper-evident and exportable.
Systems run in isolated network segments with no unnecessary public endpoints. Dependencies are pinned and scanned continuously.
Runtime anomaly detection with defined escalation paths and automated alerting, covered by an on-call rotation across time zones.
Architecture aligned with major enterprise and regulatory frameworks, backed by control documentation and evidence packages for procurement.
Compliance posture
Framework alignment status is presented separately from roadmap items so procurement and security reviewers can see the current posture clearly.
Security documentation available
Full control documentation, evidence packs, and completed security questionnaires are available under NDA.
Architecture and controls mapped
Control framework in place
Data residency and processing controls
India data protection compliance
BAA available upon request
Scoping available for card-data flows
| Framework | Status | Notes |
|---|---|---|
| ISO 27001 | Aligned | Architecture and controls mapped |
| SOC 2 Type II | Aligned | Control framework in place |
| GDPR | Aligned | Data residency and processing controls |
| DPDP Act 2023 | Aligned | India data protection compliance |
| HIPAA | Roadmap | BAA available upon request |
| PCI DSS | Roadmap | Scoping available for card-data flows |
VertexNirvana's security architecture — applied consistently across every product we build.
Request documentationResponsible disclosure
We welcome good-faith security research. Reports sent to operations@vertexnirvana.com are triaged within 24 hours. We do not pursue legal action against researchers acting in good faith.