A platform enterprise evaluators can put their name behind.

Tenant isolation by construction

Isolation is not a policy we promise to follow — it is how the data model is built. Every row carries an organization key, and matter access is authorized on every single read. Cross-tenant retrieval is prevented by construction and covered by tests, so one customer's evidence is never reachable by another customer, and never by any other Nimavera product.

Data handling & residency

Uploads go straight into private object storage and are only ever served through short-lived signed URLs. Data is encrypted in transit (TLS) and secrets are encrypted at rest. Your evidence is stored and backed up in the region of the deployment you signed up to, listed on the sub-processors page. Analysis and transcription run through OpenRouter, restricted to approved providers with zero-retention, no-training routing required on every request — their processing region is listed on the sub-processors page rather than assumed.

• Private object storage — no public links, ever.
• TLS in transit; secrets encrypted at rest.
• Storage region stated per deployment, never assumed.
• Retention follows your plan and matter settings; deleted thereafter, subject to legal hold.

Access control

Sign-in supports two-step verification (authenticator app, emailed code or recovery code), which is required for our platform admins, and server-side session revocation, with protection against repeated failed logins. Inside an organization, access is governed by roles and matter-level permissions. The application admin console does not expose recordings or transcript text. Exceptional infrastructure access is a restricted, time-limited and logged break-glass operation.

Evidence integrity

Provenance is captured, not asserted. Source hashes and upload manifests record where material came from and how it was processed; verification snapshots capture its state; and evidence handling, processing, AI activity, access, reviews, corrections, exports, sharing, and account changes are written to an append-only, hash-chained audit trail. The trail stores operational metadata, not evidence, prompts, or answers. Legal hold suspends deletion for a matter, and findings can be shared through secure links that expire and can be revoked at any time.

• Source hashing + upload manifests capture provenance.
• Comprehensive, hash-chained metadata audit trail.
• Legal hold suspends deletion.
• Secure shares expire and are revocable.

Sub-processors

We use a small, vetted set of sub-processors — managed hosting and compute, S3-compatible object storage, and configurable transcription and analysis providers — each bound by a data-processing agreement. Providers are named by role, several are configurable per deployment. The current, versioned list lives on the Sub-processors page.