# Security and trust > How Neural Inverse protects your code and data: where it runs, how it is isolated, encrypted and recorded, and how to report a vulnerability. Source: https://neuralinverse.com/trust/ --- ![](/photos/facility.jpg) Security and trust # Your code and data stay under your control. How Neural Inverse protects what you build: where it runs, how it is isolated and recorded, and how to work with our security team. Where it runs ## You choose where your data lives. - **Self-hosted:** Runs on your servers. Your code, prompts and records stay on your network; we receive none of it. - **In your cloud:** Runs in your own AWS, Azure or Google Cloud account, under your keys and network controls. - **Air-gapped:** Installs from an offline bundle and runs with no internet connection, using models you host. - **Hosted by us:** We run it for you, with the same controls and audit record: shared in AWS US East (N. Virginia) or Europe (Frankfurt), or dedicated in the AWS, Azure or Google Cloud region you prefer. Built-in controls ## Security that is part of the product. - **Tenant isolation:** Every organisation's data is separated by the database itself, with row-level security that fails closed. - **Encryption:** Traffic is encrypted with TLS. Secrets, credentials and sensitive records are envelope-encrypted with keys in a key management service, and you can bring your own keys. - **Tamper-evident audit:** Every action by a person, agent or command is written to a hash-chained log that can be verified offline. - **Identity:** Single sign-on with SAML or OIDC, directory sync with SCIM and LDAP, passkeys and multi-factor authentication. - **AI controls:** Approved models only, data loss prevention on prompts and context, and approvals for risky agent actions. - **Data residency:** Bind your organisation to a region; its content and processing stay there. On the shared service, sign-in details are held in the United States; dedicated and self-hosted deployments keep them in your region. AI and your data ## Every model request goes through your controls. - **One way to models:** Engineers and agents reach models only through the gateway you control, with your approved list. - **Checked before it leaves:** Prompts, tool calls and context pass data loss prevention before they reach a model. - **Attributed:** Every model request and agent action is tied to a person or an agent identity. - **Your keys, your providers:** Use your own provider agreements or self-hosted models; provider keys stay in the vault. How we build it ## Security tested on every change. - **Attack tests in CI:** Security tests attack each defence directly, and each test is proven to fail when its defence is removed. - **Cross-tenant tests:** Automated tests try to read and write across organisations as the runtime database role, on every change. - **Fails closed:** If an isolation setting, policy check or audit write fails, the request is refused rather than allowed. - **No outside calls:** The platform makes no calls to external services at runtime, so it runs the same on a closed network. - **Watches itself:** Admission control, circuit breakers and supervised background jobs keep the platform stable under load and failure. Standards ## Evidence for your audits. Govern checks your controls against rule packs for frameworks such as SOC 2, HIPAA, GDPR, ISO 42001 and the EU AI Act, and exports the evidence for your auditors. That evidence supports your certification; it is not a certification of your system or of Neural Inverse. Certification stays with your organisation and its assessor. For your security review, ask us for our current security documentation and questionnaire responses. Under a non-disclosure agreement, your team can review the source code, receive our capacity and benchmark reports, and run our benchmark tools on your own hardware. [Request security documents](https://neuralinverse.com/trust/documents/) [Download the security overview (PDF, 1.1 MB)](https://neuralinverse.com/neural-inverse-security-overview.pdf) Report a vulnerability ## Found a security issue? Email [security@neuralinverse.com](mailto:security@neuralinverse.com). We acknowledge reports within 72 hours and work with you on a fix and coordinated disclosure. [Read the disclosure policy](https://neuralinverse.com/trust/vulnerability-disclosure/) Documents - [Vulnerability disclosure policyHow to report a vulnerability and what we commit to.](https://neuralinverse.com/trust/vulnerability-disclosure/) - [Security documentsRequest our security pack, questionnaire responses and DPA under NDA.](https://neuralinverse.com/trust/documents/) - [Software supply chainVerify a release: checksums, signatures, provenance and SBOMs.](https://neuralinverse.com/trust/supply-chain/) - [Red-team testingThe attackers we assume, the tests that play them, and what we do not claim.](https://neuralinverse.com/trust/security-testing/) - [Security advisoriesFixed vulnerabilities in our products, and what to do.](https://neuralinverse.com/trust/security-advisories/) - [Responsible AIThe principles we build AI for regulated engineering by.](https://neuralinverse.com/trust/responsible-ai/) - [Sub-processorsWho processes personal data for the service we host.](https://neuralinverse.com/legal/subprocessors/) - [Privacy noticeHow we handle personal information.](https://neuralinverse.com/legal/privacy/) - [Security architectureTechnical detail for your security review, in the documentation.](https://neuralinverse.com/docs/security/) - [LegalTerms, cookies, accessibility and company information.](https://neuralinverse.com/legal/) ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)