Security
A trust architecture
How NubliVault protects your data — and what Nublify can and cannot see.
Threat model
| Threat | NubliVault control | Evidence |
|---|---|---|
| Ransomware | Object Lock (governance) at the destination: versions cannot be deleted or overwritten during the retention window. | DELETE/overwrite returns AccessDenied while the lock is in effect. |
| Insider / operator | BYOK encryption: keys belong to the customer. The operator cannot decrypt content. | Objects encrypted with the customer KMS; without the key, data is unreadable. |
| Accidental deletion | Immutability + retention; granular restore of any retained version. | File recoverable via range GET even after deletion at the source. |
| Compromised credential | Least scope per connection; AES-256-GCM secrets, masked in the UI; audit trail. | Every sensitive action recorded with user, IP and timestamp, in an append-only record. |
| Provider failure | Multi-cloud: source ≠ destination. Open, standard format readable without the tool. | Restore from another cloud/off-site with the manifest. |
Encryption
At rest
AES-256 on the archives; internal secrets with AES-256-GCM.
In transit
TLS 1.3 on every connection to providers.
BYOK / KMS
Customer-managed keys. Nublify never holds your master keys.
Rotation
With BYOK, rotation happens in the customer's KMS — NubliVault holds no master key to rotate.
Immutability (Object Lock)
At the cold destination, every archive is written with Object Lock in governance mode and a retention period. During retention, not even a compromised credential can delete or overwrite the data.
- 01
Backup written + lock applied
- 02
Deletion attempt
- 03
Blocked by retention
- 04
Data intact
Multi-tenant isolation
Archives are per client — a tarball never mixes data from different tenants. The manifest carries the client_id and every read is filtered by it; the database physically rejects a manifest entry from another client's package.
File paths
A backup package is a tar file, and tar accepts an entry name containing "../" inside it. A malicious entry can write outside the destination folder during a restore — it is a known attack, and it still works against a tool that does not validate. Every entry goes through validation before any write to disk: a rejected name never reaches the file system.
The access surface in your cloud
No key on disk
On OCI, the worker authenticates through Instance Principal: the identity belongs to the machine, and there is no API key held in a file to leak.
Scope per bucket
Permission is granted bucket by bucket, by name, and not over the whole compartment. A bucket that was not declared is not reachable.
Secrets at rest
Connection credentials are encrypted with AES-256-GCM, decrypted only in memory at the moment of use, and returned masked by the API — they never appear in full in the interface or in logs.
The AI module
Natural-language search and the restore assistant use forced tool use: the AI writes no database query and executes nothing. It only fills in the fields of a validated form, which feeds the same parameterized query used by the plain search.
- The AI never receives credentials, keys or file contents.
- Restore and deletion require human confirmation in the interface — the AI triggers neither of them.
- Every prompt and every response is recorded in the audit trail.
- With the module turned off, the product stays whole: the AI routes return 503 and nothing else changes.
Operator zero-knowledge
Nublify can see
- ●Operational metadata (sizes, counts, job times)
- ●Bucket names and paths, to orchestrate
- ●Audit logs of actions
Nublify CANNOT see
- ✕The contents of your files (encrypted with your key)
- ✕Your master keys (BYOK)
- ✕Cleartext data at any point in the pipeline
Auditability
- Every sensitive action (login, job, restore, credential change) is recorded.
- Append-only record: the application never updates or deletes an audit row.
- Filterable by user, action, type and period through the authenticated API.
LGPD
Nublify acts as data operator (Art. 5, VII). We process data under the controller's (your) instructions.
- DPA available on request
- Data residency in Brazil when required (destination in a BR region)
- You keep control: keys, retention and deletion are yours
Responsible disclosure
Found a vulnerability? Report it responsibly — we respond quickly.