Security
A trust architecture
How NubliVault protects your data — and what Nublify can and cannot see.
Threat model
| Threat | NubliVault control | Evidence |
|---|---|---|
| Ransomware | Object Lock (governance) at the destination: versions cannot be deleted or overwritten during the retention window. | DELETE/overwrite returns AccessDenied while the lock is in effect. |
| Insider / operator | BYOK encryption: keys belong to the customer. The operator cannot decrypt content. | Objects encrypted with the customer KMS; without the key, data is unreadable. |
| Accidental deletion | Immutability + retention; granular restore of any retained version. | File recoverable via range GET even after deletion at the source. |
| Compromised credential | Least scope per connection; AES-256-GCM secrets, masked in the UI; audit trail. | Every sensitive action in a signed log. |
| Provider failure | Multi-cloud: source ≠ destination. Open, standard format readable without the tool. | Restore from another cloud/off-site with the manifest. |
Encryption
At rest
AES-256 on the archives; internal secrets with AES-256-GCM.
In transit
TLS 1.3 on every connection to providers.
BYOK / KMS
Customer-managed keys. Nublify never holds your master keys.
Rotation
Key rotation supported, without rewriting the archives.
Immutability (Object Lock)
At the cold destination, every archive is written with Object Lock in governance mode and a retention period. During retention, not even a compromised credential can delete or overwrite the data.
- 01
Backup written + lock applied
- 02
Deletion attempt
- 03
Blocked by retention
- 04
Data intact
Multi-tenant isolation
Archives are per client — a tarball never mixes data from different tenants. The manifest carries the client_id and every read is filtered by it; the database physically rejects a manifest entry from another client's package.
Operator zero-knowledge
Nublify can see
- ●Operational metadata (sizes, counts, job times)
- ●Bucket names and paths, to orchestrate
- ●Audit logs of actions
Nublify CANNOT see
- ✕The contents of your files (encrypted with your key)
- ✕Your master keys (BYOK)
- ✕Cleartext data at any point in the pipeline
Auditability
- Every sensitive action (login, job, restore, credential change) is recorded.
- Immutable trail and signable logs.
- Export to your SIEM.
LGPD
Nublify acts as data operator (Art. 5, VII). We process data under the controller's (your) instructions.
- DPA available on request
- Data residency in Brazil when required (destination in a BR region)
- You keep control: keys, retention and deletion are yours
Responsible disclosure
Found a vulnerability? Report it responsibly — we respond quickly.