Security — hosted or self-hosted

How NerveStax keeps your platform and data safe.

Agents work in their own sandboxes, on your model key. A person approves before an agent opens a pull request or runs anything in your orchestrator. Here is what that means in practice.

Report a vulnerability

Deployment

Hosted or
self-hosted

Two ways to run the same product. Pick the one your security team prefers.

Hosted by NerveStax

We run it for you

Runs on Google Cloud in the United States (us-central1). Need a different region or cloud? Talk to us.
TLS for traffic, and required for database connections. Data at rest encrypted by Google Cloud.
Daily database backups with point-in-time recovery.
Deployment secrets held in Google Cloud Secret Manager; release images pinned to a specific build.

Self-hosted

Run it on your Kubernetes

A Helm chart on your own Kubernetes, with your own Postgres.
Nothing leaves your network except calls you configure: your LLM provider, warehouse and git host.
No telemetry, usage reporting, licence check or call-back to NerveStax. The encryption key lives only in your deployment.
Optional Kubernetes sandboxes run as non-root with all Linux capabilities dropped, seccomp, no service-account token and a hard lifetime, behind a NetworkPolicy that blocks private ranges and the cloud metadata endpoint (where your cluster enforces NetworkPolicy).

Model and data

Your model,
your key

Bring your own key

Each organization adds its own model provider key. NerveStax has no fallback key.

AnthropicOpenAIAzure OpenAIOpenAI-compatible

An OpenAI-compatible endpoint can front a self-hosted model. If data must not reach an external model, point NerveStax at one.

The product ships no third-party analytics or error-tracking SDKs.

What the model sees

Schemas and table metadata
dbt manifest, lineage and run results
Repository files
Command output and Airflow logs — secrets redacted
Alert payloads
Query results — when an agent queries or samples a table: the rows it retrieves

It goes to your provider, under your key and your agreement with them.

Secrets

Stored encrypted.
Never shown back.

AES-256-GCM

Warehouse credentials, git tokens, model keys and secret env vars, encrypted with a key held outside the database.

Write-only

You can replace a secret, but no endpoint reveals it. Screens show names or masked values.

Redacted

From logs, and from command output, file reads and Airflow logs before the model reads them.

Scrubbed from chat

Credentials pasted into a conversation are scrubbed before the message is stored.

Hashed machine tokens

Alert webhook and Airflow tokens: random 256-bit, stored only as a hash, shown once, revocable, optional expiry.

One-repo GitHub tokens

GitHub App access tokens are narrowed to a single repository, with contents and pull-request write permissions.

Agents and approvals

Agents act only
with approval

Each conversation runs in its own sandbox, cleaned up when idle and capped at three days. The actions below stop and wait for a person.

A person approves before an agent

Opens a pull request
Triggers, clears or pauses Airflow runs
Runs a backfill
Runs an ingestion
Runs non-read SQL against a source
Fetches a connection secret (masked)
Runs dbt on a project you mark as protected

No merge: NerveStax has no merge capability. Changes arrive as pull requests that your repository’s own review rules govern.
Own branch only: Agents can push only to their own conversation branch.
No auto-approval: Irreversible actions, such as installing or stopping an ingestion, can never be auto-approved.
On the record: Each approval request and decision is kept in the conversation’s history.

On-call

On-call is
read-only

Read-only tools

The on-call agent has no repository, sandbox or write access.

Untrusted input

Alert payloads are treated as untrusted input and capped in size.

Escalates when unsure

If triage fails, times out or is unsure, the alert is escalated anyway. About on-call ›

Accounts and records

Who can do what,
and what is kept

Access

Organization roles: owner, admin, engineer.
Changing members, secrets, connections, model providers, git credentials, tokens, alerts, schedules, backfills or ingestion requires the matching permission.
Sessions are checked server-side on every request.
The agent connection uses a short-lived token scoped to one conversation.

Records

Token usage of every model call, per user, agent and model.
Each conversation’s full timeline of tool calls, results and approvals.
The git operations agents perform.

Secure development

How we
build it

Tested on every change

Lint, type checks, unit, integration and migration tests, and end-to-end browser tests in CI.

Locked dependencies

Dependencies install from lockfiles.

No committed keys

Pre-commit checks block committed private keys.

Safe production defaults

Production refuses to start with development keys or settings.

Subprocessors

Who runs
hosted NerveStax

Subprocessor	Purpose
Google Cloud	Hosting, database and secret storage, in the United States
E2B	Isolated code sandboxes
Your LLM provider	Model calls, with your own key

Self-hosted deployments call only the services you configure.