Datasheet · Security and compliance Nothing improvises on your endpoints.
Every fix Nanoheal runs is validated, versioned and sealed, so it runs the same way every time. You decide what runs silently, what needs a click and what waits for an approval. This sheet covers the gates every fix passes, the controls in the product today, how the AI is governed, and what your security review can request.
Every fix passes the same four gates
- Reviewed
- Capabilities reach endpoints through staged, approved and versioned publishing. Nothing goes live until a person signs it off.
- Staged
- Publish to a pilot group, check the result, then widen the rollout.
- Logged
- The audit log shows who changed what, who approved it and where it ran.
- Reversible
- Nanoheal handles software distribution and patch install with rollback, so a bad update can be undone.
Controls that ship in the product today
| Control | What it does |
|---|---|
| Access | Role-based access, checked on every capability. Users act only where their role and sites allow. |
| Sign-in | Time-based one-time password MFA with backup codes for console users, plus SAML and OIDC single sign-on configured per site. |
| Tenancy | Each customer or business unit is a site, with data scoped to each site and requests for another site refused. |
| Secrets | Passwords are hashed, with secret fields stripped from responses and redacted from logs. |
| API access | Site-scoped API keys, stored only as hashes, each limited to read or write. |
| Device identity | Mutual TLS between agent and server, with certificates admins can list and revoke. |
Compliance. SOC 2 Type I, SOC 2 Type II in progress, and GDPR.