Security

Built to be answered for.

Novamind Labs is building Novie, the enterprise agentic AI platform: the platform organisations use to build, run and govern their AI workforce. Your agents. Your models. Your cloud. Novamind exists so enterprises can account for the AI they run, and that standard applies to the platform itself. This page describes how we protect the Services, your data and your people, and what you can ask us for.

Security and legal contact: legal@novamindlabs.ai
Report a vulnerability: see section 13
Request documents: see section 14

1. Our approach

Novie Control, Novie Build and MyNovie are built for organisations that have to answer for what AI is doing. So the platform is:

• Governed by default, not by policy document. Guardrails, budgets, approvals and audit are features of the platform, on from the first day, not rules that live in a PDF.
• Read-first. Novie Control reads usage, cost and policy signals across your AI estate and changes nothing in your systems.
• Scoped by you. Nothing is read from a connected system until an authorised administrator connects it and sets its scope, and what is in scope is visible to the people it covers.
• Neutral by design. We have no model of our own to sell, so we do not train models on your data.

2. Compliance and assurance

Novamind is an early-stage company. We do not yet hold ISO/IEC 27001, ISO/IEC 42001 or SOC 2 certification, and we would rather tell you that than imply otherwise. We will update this page when we begin a formal certification programme.

What we offer today is transparency: this page describes the controls we run, we answer security questionnaires in full, and we support customer due diligence, including architecture walkthroughs with our engineers.

3. Product security

Identity and access

• Single sign-on through SAML 2.0 and OIDC with common enterprise identity providers. Contact legal@novamindlabs.ai to confirm support for yours.
• Multi-factor authentication for accounts that do not use single sign-on.
• Role-based access control with advanced roles. Access follows the person's role at the source: a user sees through the platform only what they are already permitted to see in the connected system.
• Session management with configurable timeouts and administrator-forced sign-out.

Governance built in

• Budgets and caps at organisation, team, project and person level, with pace and over-run projection.
• Approval workflows for budget increases, agent deployment and high-impact agent actions, with the decision recorded against a named person.
• Model policy: which models can be used for which work, including restrictions to private or in-region models.
• Guardrails on agent actions: allowed tools, allowed systems, allowed scopes, and required approvals.

Audit trail

• Agent runs, model calls, actions, approvals and configuration changes are logged with who, what, when and under which policy.
• Audit logs are exportable and retained as configured by the customer.
• Board-ready reporting on spend, usage, governance and risk in Novie Control.

4. Data handling

Your data stays inside your boundary

• Each customer's data is logically isolated from every other customer's.
• Customers can discuss data residency requirements with us, including in-region hosting. Contact legal@novamindlabs.ai.
• Private and self-hosted models: work can be routed to models inside the customer's own environment, in which case prompts and data never leave it.

Masking

• Where masking rules are configured, data matching them is masked before it is processed.
• Customers can add masking rules for their own sensitive fields.

Permissioned end to end

• Permissions are role-aware and inherited from the source system. Scope is set by an administrator before anything runs, and is visible to the people it covers.
• Agents run with the least privilege needed for their task, scoped to the systems and actions their owner has approved.

No training on customer data

• We do not use customer prompts, outputs, connected data or agent definitions to train or fine-tune any model. The commercial model providers we connect to are used through their business and API services, whose terms provide that customer content is not used for training.

Deletion

• Customers can delete data at any time. On termination, data is exported on request and then deleted, with backups rolling off on a fixed schedule.

5. Encryption

• In transit: TLS 1.2 or higher for all connections, with modern cipher suites.
• At rest: industry-standard AES-256 encryption for stored data, including databases, object storage and backups.
• Key management: encryption keys are managed in our cloud provider's key management service, with access restricted to a small number of named engineers.
• Secrets: credentials for connected systems are stored encrypted in a dedicated secrets store, are never written to logs, and can be revoked by the customer at any time.

6. Infrastructure and hosting

• The Services run on established cloud infrastructure. The provider's own certifications cover the physical and infrastructure layer; they do not cover Novamind's application, and we do not claim that they do. For current hosting locations, contact legal@novamindlabs.ai.
• Production, staging and development environments are separated, with no customer data in non-production environments.
• Infrastructure is defined as code and changes are peer-reviewed.
• Network segmentation, private networking for data stores, and web application firewalling on public endpoints.

7. Access control inside Novamind

• Access to production systems and customer data is restricted to named engineers who need it for their role, and is time-limited.
• Multi-factor authentication is required for all production access.
• Access is reviewed regularly and removed promptly when someone leaves or changes role.
• Administrative access is logged. Engineers do not access customer data except to resolve a support request the customer has raised, or to investigate a security incident, and such access is logged.

8. Secure development

• Every change is peer-reviewed before merge, with protected branches and mandatory automated checks.
• Static analysis, dependency vulnerability scanning and secret scanning run on every build.
• Third-party dependencies are pinned and reviewed, and vulnerable dependencies are prioritised for remediation according to severity.
• Security is part of design review for new features, with particular attention to agent permissions, prompt injection and data flows to third-party models.

9. Agent and model safety controls

Because the platform runs agents that act in customer systems, we treat agent behaviour as a security surface.

• Least-privilege agents. Every agent has an owner, an approved set of tools and systems, and a budget.
• Prompt injection defences. Content read from connected systems is treated as data, not as instructions, and high-impact actions require approval regardless of what an agent reads.
• Human approval for high-impact actions. Configurable per action type, per system and per agent.
• Kill switch. Administrators can pause any agent, team or the whole estate immediately from Novie Control.
• Model routing policy. Restrict sensitive work to approved, in-region or private models.
• Trace from goal to deployment. Every agent built in Novie Build keeps a trace from business goal to deployment, so an auditor can see why it exists and what it was allowed to do.

10. Monitoring and vulnerability management

• Centralised logging of application, infrastructure and security events.
• Automated alerting on anomalous access, privilege changes, unusual spend and failed authentication.
• Regular vulnerability scanning of infrastructure and applications, with critical findings prioritised for immediate remediation.

11. Incident response

• A documented incident response plan with defined severity levels and escalation to leadership.
• Customers are notified of a confirmed security incident affecting their data without undue delay, with what happened, what data was affected, what we have done, and what we recommend.
• Privacy breaches likely to cause serious harm are notified to the Office of the Privacy Commissioner and affected individuals as soon as practicable, as the Privacy Act 2020 requires, and to other regulators where their laws apply.
• Significant incidents end with a written post-incident review, shared with affected customers on request.

12. Business continuity and people

• Encrypted backups are taken regularly, stored separately from production, and restore procedures are tested.
• Production services are deployed across multiple availability zones.
• Staff complete background checks before they start, as permitted by law, and receive security and privacy training at onboarding and on an ongoing basis.
• All staff and contractors sign confidentiality agreements.
• Company devices are managed, with disk encryption, screen lock, endpoint protection and automatic updates.

13. Responsible disclosure

We welcome reports from security researchers and will work with you in good faith.

In scope

• novamindlabs.ai and its subdomains, the Novie Control, Novie Build and MyNovie applications, and our public APIs.

Out of scope

• Third-party systems and model providers, denial of service, social engineering of staff or customers, physical attacks, spam and rate-limiting findings, reports from automated scanners without a demonstrated impact, and clickjacking on pages with no sensitive actions.

Rules

• Test only against accounts you own or have permission to test. Do not access, modify or exfiltrate data belonging to others. Stop and report as soon as you have a proof of concept. Do not disrupt the Services. Do not publish a vulnerability until we have resolved it or 90 days have passed, whichever is earlier, and coordinate timing with us.

How to report

• Email legal@novamindlabs.ai with the vulnerability type, affected URL or component, steps to reproduce, proof of concept and your assessment of impact.

What we commit to

• Acknowledge your report within three business days, keep you informed of progress, credit you publicly if you wish once resolved, and not pursue legal action against research conducted in good faith under these rules. We do not currently offer a paid bug bounty.

14. Documents available to customers

Under NDA, current and prospective Enterprise Customers can request:

• Data protection terms and Standard Contractual Clauses
• Our list of service providers
• Security questionnaire responses
• Architecture and data flow overview
• Business continuity summary

Email legal@novamindlabs.ai.

15. Changes to this page

We update this page as our controls and assurance status change. Material changes are dated at the top.

Novamind Labs Limited, 34 Tritton Drive, Rosedale, Auckland 0632, New Zealand. hello@novamindlabs.ai