Introduction
Nivo is purpose built for UK financial services firms that need to exchange sensitive information with absolute confidence. Our platform combines bank grade encryption, a rigorously audited information security management system, and a transparent AI governance framework. The result is a secure, compliant environment for every broker, lender and customer interaction—whether you're sending a message, gathering KYC evidence or automating tasks with our new AI services.
Security & Compliance at a Glance
- End to end encrypted messaging, document exchange and task automation
- Hosted exclusively in AWS EU West 1 (Ireland) for guaranteed EEA data residency
- 100+ regulated lenders, building societies and broker networks already live on Nivo
- Immutable audit trail for every message, file, identity check and AI action
Certifications & Independent Assurance
| Certification | Scope | Status |
|---|---|---|
| ISO 27001 | Information security management system | Audited & Certified |
| Cyber Essentials Plus | UK Government cyber security baseline | Audited & Certified |
| FSQS | Financial Services Supplier Qualification System | Registered |
| DIATF | Digital Identity & Attributes Trust Framework – Identity Orchestrator | Audited & Certified |
| ISO/IEC 9001 | Internationally recognised standard for Quality Management Systems | Audited & Certified |
| ISO/IEC 42001 | AI management system | Audited Certified |
Regular CREST aligned penetration tests are performed, and clients may conduct their own tests at any time.
Data Residency & Hosting Architecture
- All traffic terminates at EU endpoints.
- Dedicated AWS VPC with three availability zones delivers 99.99% uptime.
- Every client operates in a logically segregated instance for strict tenancy isolation.
Encryption & Secure Data Handling
| Layer | Control |
|---|---|
| In transit | TLS 1.2+ across all external and internal channels |
| At rest | AES 256 encryption on every datastore |
| Message content | Extra per tenant keys provide end to end message security |
| Back ups | Encrypted, multi zone replicas with least privilege access |
Identity, Authentication & Access Control
Customers: Device registration + PIN or biometrics, with optional biometric ID&V.
Staff & Brokers: SSO (OIDC/SAML), MFA, IP whitelisting and granular role based access.
Every action is linked to a verified identity and stored on an immutable audit trail.
Responsible AI Governance
- Governed by a published AI Policy aligned to ISO/IEC 42001 principles.
- AI layer automates administrative tasks, not credit decisioning, keeping humans in the loop.
- Robust LLM data-protection agreements (Google Gemini Enterprise, OpenAI pay-as-you-go) ensure that no client data is used to train underlying models.
- All AI calls route via EU endpoints; outputs, prompts and function calls are captured in the audit trail.
Supplier & Sub Processor Management
- Full sub processor register published; all vendors bound by GDPR compliant terms with explicit "no model training" clauses.
- Onboarding reviews cover security posture, privacy controls, modern slavery and ESG criteria.
Continuous Monitoring, Testing & Incident Response
- 24 × 7 monitoring with AWS GuardDuty, CloudWatch and AWS Inspector.
- Automated testing via CI/CD pipelines.
- Formal incident response and patch management processes under ISO 27001.
Frequently Asked Due Diligence Points
Where is my data stored?
Solely in AWS EU West 1 (Ireland).
What encryption is used?
TLS 1.2+ in transit; AES 256 at rest; per tenant keys for messages.
Do you support SSO & MFA?
Yes—OIDC/SAML plus MFA and optional IP restrictions.
Pen tests?
Independent, CREST aligned tests every year (reports available under NDA).
GDPR & DPIA support?
Built in DPO oversight, template DPIAs and GDPR ready contracts.
How is AI controlled?
ISO 42001 aligned policy, robust LLM data-protection agreements with no data training, human oversight and full auditability.
.avif)