Security

1. Our approach

Security and governance are central to what Niutech Pty Ltd (ABN 91 691 210 429) is building. This page describes our security posture for the current niutech.ai marketing website and early-access waitlist. It will be expanded as we launch the Niutech product (accounts, teams and the software factory).

2. The data we hold today

The public site collects very little: only the email address you provide to join the waitlist, plus limited technical logs generated by our infrastructure. We do not collect payment, financial, health, or other sensitive information on this site. Minimising the data we hold is itself a security control.

3. Infrastructure

The site and its data are hosted on reputable, security-conscious providers:

• Vercel — website hosting and delivery, served over HTTPS/TLS;
• Supabase — a managed PostgreSQL database that stores waitlist sign-ups.

All traffic to the site is encrypted in transit.

4. Access and secrets

Access to our systems and data is limited to authorised personnel on a need-to-know basis. Application secrets and API keys are held in our providers' managed environment stores — not in source code. Waitlist data is protected by database row-level security, so it can only be written by our server, not read or altered by public clients.

5. Data storage and transfer

Data is encrypted in transit (HTTPS). Our providers may store and process data outside Australia; how we handle international transfers is described in our Privacy Policy.

6. Monitoring and incident response

We monitor our services for availability and abuse, and we aim to respond promptly to any security incident. Where an incident affects your personal information and the law requires it, we will notify you and the relevant authority.

7. Responsible disclosure

If you believe you have found a security vulnerability in niutech.ai, please email security@niutech.ai with the details. We ask that you act in good faith — do not access, modify, or delete data that isn't yours, avoid privacy violations and service disruption, and give us reasonable time to investigate and remediate before any public disclosure. We appreciate the security community's help in keeping Niutech safe.

8. As the product develops

The Niutech software factory is being built with governance, security and auditability at its core — so that building with AI opens no new attack surface rather than widening it. Its security design centres on a one-way data boundary: the factory's worker runs inside the customer's own environment, and source code, diffs, secrets, prompts and model keys never cross to Niutech — only workflow status and evidence metadata do.

As we launch product features we will add and document the controls a regulated customer's security and risk teams expect, including:

• a field-classified, validator-enforced data boundary — code and secrets never leave the customer environment;
• per-job isolation — each run in its own sealed, outbound-only workspace, destroyed with its secrets on completion;
• short-lived, scoped credentials, resolved customer-side and never placed in images, logs or events;
• human approval gates on sensitive actions, with immutable, attributable audit and content-addressed evidence;
• per-tenant data isolation and a defined off-boarding, export and deletion procedure.

We build to recognised engineering and security standards (including ISO/IEC 25010, a STRIDE threat model, and container-hardening / Restricted Pod Security), and design our controls to support customers' assurance and regulatory obligations — such as SOC 2, ISO 27001, APRA CPS 230 and CPS 234, DORA and the GDPR — with control-mapping extensible to a customer's specific regime. We do not claim certifications we do not yet hold; where independent attestations apply, we will document them here as they are obtained.

9. Contact

Security questions or reports: security@niutech.ai (Niutech Pty Ltd, New South Wales, Australia).