Security

Security at Nivas AI

Last updated · July 2026

Security is part of our engineering foundation, not an afterthought. Because our products handle voice, personalization, multi-tenant data, and sensitive-content safety, we design for security from day one across the whole portfolio.

How we build

• Secrets stay server-side. Paid AI and third-party API calls are routed through server-side proxies; provider keys are never shipped in client applications.
• Tenant isolation by design. Multi-tenant products isolate each customer's data with row-level security and least-privilege access.
• Auditability. Event logs are append-only where integrity matters, supporting traceability and review.
• Safety layers. Products that generate or accept open-ended content include safeguards that detect sensitive information and inappropriate content.
• Defense in transit. The website and services are served over HTTPS with modern security headers.

Privacy-sensitive features

Features such as voice cloning and character personalization are opt-in and controlled by the account holder. We minimize the data we collect and retain, and each product documents its specific protections.

Responsible disclosure

If you believe you have found a security issue, we want to hear from you. Please contact us with details, and allow us reasonable time to investigate and remediate before any public disclosure. We appreciate the security community's help in keeping our users safe.

This overview describes our security approach as a pre-launch studio and will be expanded with product-specific documentation as each product ships.