Built for the people who answer to auditors.

How workspaces are kept apart, where secrets live, how writes are gated, and what happens to your data.

Workspace isolation

Every workspace's data is isolated at the database level, with row-level security. Connectors, Apps, results and settings never cross between workspaces.
Each workspace connects its own accounts. Credentials are never shared between workspaces.
A connection is pinned to the company or org it was connected to. Reconnecting it to a different one is refused.

Connector credentials and AI keys are encrypted at rest (AES-256-GCM) and are never returned to the browser.
A trusted broker attaches credentials to each call and drops them when the run ends. Apps never hold a secret.
LogicScript is a restricted language that Netridium runs itself. It has no file, network or library access, and reaches your systems only through the connector calls written in it.

Read-only by default. A write needs Allow updates on the App, Allow updates on the connector and, for Xero, QuickBooks Online and Salesforce, a read-write connection. All three start off.
Every write-enabled run asks for confirmation before it starts, with its inputs read back.
Every run has a ceiling on cost, duration and number of updates, enforced while it runs. Limits fail closed; there is no "no limit".
Each write is recorded before it is sent, so an interrupted run never sends it twice.
Dry run reads for real and lists the changes a LogicScript would make, without making them.

Passwords must be at least 12 characters and are screened against passwords found in past breaches.
Admins always sign in with two-step verification. A workspace can require it for everyone, including its service provider and Netridium support.
Single sign-on with Okta, Microsoft Entra ID, Ping or any SAML 2.0 provider, on Enterprise. Admins keep password sign-in, so an identity-provider outage cannot lock them out.
Each company decides whether its service provider, or Netridium support, may open its workspace, and for how long. A support exception is time-boxed and written to that workspace's audit log.

The audit log records who ran what against which data, every connector write, every script approval and every admin change.
Admins can search it, filter it by date and download it as CSV.
Every run records its token usage and cost, rolled up by day, folder, App, cost center and user.

The application and database are hosted in the United States (US East, Ohio) on Render and Supabase. Data is encrypted in transit (TLS) and at rest.
AI supplied by Netridium runs on Anthropic's Claude models. Our contract with Anthropic does not permit training generally available foundation models on your inputs or outputs.
With bring your own key (BYOK), prompts go to Anthropic under your own account and terms. Run limits, budgets and the audit log still apply.
Subprocessors: Supabase, Render, Postmark, Maxio and Anthropic. See the subprocessor list for what each does and where; changes are announced 10 days in advance.

SOC 2 Type II is on the roadmap. Netridium does not hold a SOC 2 report or any other certification today.