SELVO
Security
SELVO is designed so that your data never leaves your infrastructure. This page documents the enforced controls that guarantee that — written for CTOs, CISOs, and procurement teams.
Security Overview
SELVO is built around a single principle: your data never leaves your infrastructure. Every component of the platform runs inside your private network — no external cloud services are involved at any point during operation.
Selvo Lab has no access to your data, documents, search queries, or AI responses. The controls described on this page are enforced system behaviours, not optional configuration.
Data & Infrastructure
All system components operate exclusively within your private network. Every service communicates internally — no external cloud calls are made during normal operation.
After initial deployment, the system has no internet dependency. It can run fully air-gapped, with no ongoing connectivity required.
The AI model runs on your own hardware. No queries, documents, or responses are transmitted to any external party, including Selvo Lab.
Selvo Lab has zero visibility into your deployment, your data, or how the system is used.
Access Control
Authentication
Users authenticate with a username and password. Passwords are hashed using a strong adaptive algorithm and are never stored in plain text.
On login, users receive a short-lived access token valid for 30 minutes and a refresh token valid for 7 days. Each token is uniquely tracked — users can invalidate all active sessions immediately at any time. Password requirements enforce minimum length and character variety.
Roles & Scope Enforcement
The system enforces four role tiers — Admin, Policy Maker, Department Manager, and User — with strictly bounded privileges per role. Administrators cannot grant permissions above their own level.
Every account is scoped to a specific tenant and department. Scope is enforced silently on every request — no data from outside a user's assigned scope is ever returned, even partially.
If an account has no department assignment, access is denied by default. The system fails closed, not open.
Policy Maker accounts are architecturally separated from operational workspace surfaces. Governance and day-to-day operations run in distinct contexts with no access overlap.
Rate Limiting
Per-user and global rate limits are enforced on all endpoints. Sensitive operations — including data exports and deletion requests — have stricter limits. Requests that exceed those limits are rejected before processing begins.
Encryption & Transport
All traffic is encrypted in transit. HTTPS is enforced on all endpoints, with strict transport security headers that prevent protocol downgrade attacks.
Every server response includes security headers that prevent data exfiltration via content injection, block clickjacking, enforce content-type expectations, and restrict referrer information.
Governance policy artifacts are cryptographically signed before deployment. The production runtime verifies each signature before activation and fails closed if the signature is invalid or absent. Policy activation is atomic and concurrency-safe — partial or inconsistent policy states are not possible.
The production runtime is verify-only. It cannot create or sign new policies — all signing occurs offline, outside the production environment.
Audit Trail
Every action performed through the system is automatically logged. Each record captures the acting user, the action performed, the targeted resource, the outcome, duration, source address, and timestamp.
A separate audit trail tracks all GDPR-relevant events: consent records, deletion requests, and data export actions.
The governance policy audit chain is append-only. Modification or deletion of audit records is blocked at the storage layer — records cannot be altered after the fact, even by administrators.
All audit logs are queryable by authorised administrators for compliance, investigation, and reporting purposes.
Vulnerability Management
Every release undergoes automated vulnerability scanning across all dependencies — both server-side and client-side. High-risk vulnerabilities block the release from proceeding.
A mandatory release gate must pass before any change reaches production. Artifacts are promoted by immutable digest — once a release clears the gate, the artifact cannot be modified.
Runtime health checks and smoke tests run as part of every deployment to verify system integrity before traffic is accepted.
Data Lifecycle
When a document is deleted, it is removed from all search indexes and the document ledger simultaneously. The document ledger is the authoritative source of truth — a deleted document cannot be re-introduced by system migrations or updates.
User account deletion is a hard delete. All associated sessions and data are removed through cascading constraints — no orphaned records remain.
Automated retention policies purge old sessions, logs, and data exports on a configurable schedule.
The system supports GDPR right-to-erasure and right-to-portability. Users can export a complete copy of their data before deletion. Retention periods are configurable per deployment to match your organisation's data governance requirements.
Responsible Disclosure
If you have identified a security vulnerability in Selvo Lab's products or infrastructure, we ask that you report it to us before public disclosure.
Please send a detailed description of the issue — including reproduction steps and potential impact — to:
contact@selvolab.comWe aim to acknowledge all reports within 48 hours and will keep you informed as we investigate and address the issue.