Security and data sovereignty
The system runs inside a factory network because a customer's production footage does not have to leave their premises for analysis. This page answers the questions a technical due-diligence team typically asks, with the real status attached to each one.
Where is data stored?
The system can be deployed fully on-premises, inside the customer's own network, with no internet connection required to operate.
AI inference runs at the edge, on a processing box on the factory floor or on the camera itself. As a result, production footage does not have to leave the customer's premises to be analyzed.
Who can see what?
The system applies role-based access control: each user is granted permissions specific to their job function, rather than a single shared account with full access.
Access to live view, snapshots, stored video, and device configuration is segmented by role, limiting exposure of sensitive data to what is actually needed.
How is data encrypted?
Device credentials (camera usernames and passwords) are encrypted at rest using Fernet symmetric encryption before being written to the database, never stored as plaintext.
Data in transit is protected via SSL/TLS as standard practice, applied to connections between clients, the server, and devices.
Path traversal protection
Every API that serves or downloads a file (snapshots, recorded video, exported reports) validates and normalizes the requested path before returning the file to the client.
This closes one of the most common vulnerabilities in file-serving systems: using "../" sequences or absolute paths to read files outside the permitted scope.
How are faults handled?
The system runs on a custom exception hierarchy, SOAIException, with no silent fallback path. Every fault (a DB error, a corrupted file, a blurry QR code, a dropped camera connection) surfaces as an explicit error instead of being caught and ignored. Each error returns an RFC-compliant HTTP response with a clear error code, and is logged in detail server-side.
A silently swallowed exception can hide exactly what a security team needs to see: an abnormal access pattern, a data-integrity fault, or an early sign of a breach. This mechanism was verified in 27 stress tests with blurred video, corrupted files, and dropped connections.
Compliance roadmap
Nỏ Thần Agentic does not currently hold certifications such as ISO/IEC 27001 or SOC 2. We state this upfront, because we believe an honest profile with clear status beats one that looks "complete" but cannot withstand scrutiny. The table below reflects the actual current state.
| Item | Status | Expected milestone |
|---|---|---|
| Encryption at rest (Fernet) | in production | Implemented in production |
| Role-based access control | in production | Implemented in production |
| Path-traversal protection on file APIs | in production | Implemented in production |
| Explicit exception handling (SOAIException) & logging | in production | Implemented in production |
| ISO/IEC 27001 certification | on roadmap | Roadmap being scoped, no public date yet |
| SOC 2 certification | on roadmap | Roadmap being scoped, no public date yet |
We do not display any certification badge or logo we have not actually earned. If a partner's due-diligence process needs more specific evidence for any line above, we are glad to provide detailed technical documentation on request.
Need more detailed security documentation?
We can provide detailed technical documentation on architecture, encryption, access control, and incident handling for a partner's due-diligence team.
Request detailed security documentation