Trust
Security
Norvus uses authenticated sessions, tenant isolation, audit logging, and explicit safety gates around broker-related automation.
Access control
- JWT-based authentication with secure cookie support
- Tenant and user scoping on protected routes
- Role-aware access for admin-only operational surfaces
Auditability
- Security-sensitive actions are recorded in audit events
- Operational failures are raised as structured alerts
- Managed-service controls remain config-driven rather than hardcoded
Data handling
- TLS and secret management are mandatory production controls
- Portfolio, risk, and decision data remain user-scoped
- Support and billing shell work must preserve tenant ownership boundaries